+
+
+
+ Configuration for Joohoi’s ACME-DNS.
+
acme-dnsHere is an example bash command using the Joohoi’s ACME-DNS provider:
+ACME_DNS_API_BASE=http://10.0.0.8:4443 \
+ACME_DNS_STORAGE_PATH=/root/.lego-acme-dns-accounts.json \
+lego --email you@example.com --dns acme-dns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ACME_DNS_API_BASE |
+The ACME-DNS API address | +
ACME_DNS_STORAGE_PATH |
+The ACME-DNS JSON account data file. A per-domain account will be registered/persisted to this file and used for TXT updates. | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Alibaba Cloud DNS.
+alidnsHere is an example bash command using the Alibaba Cloud DNS provider:
+# Setup using instance RAM role
+ALICLOUD_RAM_ROLE=lego \
+lego --email you@example.com --dns alidns --domains my.example.org run
+
+# Or, using credentials
+ALICLOUD_ACCESS_KEY=abcdefghijklmnopqrstuvwx \
+ALICLOUD_SECRET_KEY=your-secret-key \
+ALICLOUD_SECURITY_TOKEN=your-sts-token \
+lego --email you@example.com --dns alidns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ALICLOUD_ACCESS_KEY |
+Access key ID | +
ALICLOUD_RAM_ROLE |
+Your instance RAM role (https://www.alibabacloud.com/help/doc-detail/54579.htm) | +
ALICLOUD_SECRET_KEY |
+Access Key secret | +
ALICLOUD_SECURITY_TOKEN |
+STS Security Token (optional) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
ALICLOUD_HTTP_TIMEOUT |
+API request timeout | +
ALICLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
ALICLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
ALICLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for all-inkl.
+allinklHere is an example bash command using the all-inkl provider:
+ALL_INKL_LOGIN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
+ALL_INKL_PASSWORD=yyyyyyyyyyyyyyyyyyyyyyyyyy \
+lego --email you@example.com --dns allinkl --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ALL_INKL_LOGIN |
+KAS login | +
ALL_INKL_PASSWORD |
+KAS password | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
ALL_INKL_HTTP_TIMEOUT |
+API request timeout | +
ALL_INKL_POLLING_INTERVAL |
+Time between DNS propagation check | +
ALL_INKL_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for ArvanCloud.
+arvancloudHere is an example bash command using the ArvanCloud provider:
+ARVANCLOUD_API_KEY="Apikey xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
+lego --email you@example.com --dns arvancloud --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ARVANCLOUD_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
ARVANCLOUD_HTTP_TIMEOUT |
+API request timeout | +
ARVANCLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
ARVANCLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
ARVANCLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Aurora DNS.
+auroradnsHere is an example bash command using the Aurora DNS provider:
+AURORA_API_KEY=xxxxx \
+AURORA_SECRET=yyyyyy \
+lego --email you@example.com --dns auroradns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
AURORA_API_KEY |
+API key or username to used | +
AURORA_SECRET |
+Secret password to be used | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AURORA_ENDPOINT |
+API endpoint URL | +
AURORA_POLLING_INTERVAL |
+Time between DNS propagation check | +
AURORA_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
AURORA_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Autodns.
+autodnsHere is an example bash command using the Autodns provider:
+AUTODNS_API_USER=username \
+AUTODNS_API_PASSWORD=supersecretpassword \
+lego --email you@example.com --dns autodns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
AUTODNS_API_PASSWORD |
+User Password | +
AUTODNS_API_USER |
+Username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AUTODNS_CONTEXT |
+API context (4 for production, 1 for testing. Defaults to 4) | +
AUTODNS_ENDPOINT |
+API endpoint URL, defaults to https://api.autodns.com/v1/ | +
AUTODNS_HTTP_TIMEOUT |
+API request timeout, defaults to 30 seconds | +
AUTODNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
AUTODNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
AUTODNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Azure (deprecated).
+azurePlease contribute by adding a CLI example.
+| Environment Variable Name | +Description | +
|---|---|
AZURE_CLIENT_ID |
+Client ID | +
AZURE_CLIENT_SECRET |
+Client secret | +
AZURE_ENVIRONMENT |
+Azure environment, one of: public, usgovernment, german, and china | +
AZURE_RESOURCE_GROUP |
+Resource group | +
AZURE_SUBSCRIPTION_ID |
+Subscription ID | +
AZURE_TENANT_ID |
+Tenant ID | +
instance metadata service |
+If the credentials are not set via the environment, then it will attempt to get a bearer token via the instance metadata service. | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AZURE_METADATA_ENDPOINT |
+Metadata Service endpoint URL | +
AZURE_POLLING_INTERVAL |
+Time between DNS propagation check | +
AZURE_PRIVATE_ZONE |
+Set to true to use Azure Private DNS Zones and not public | +
AZURE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
AZURE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
AZURE_ZONE_NAME |
+Zone name to use inside Azure DNS service to add the TXT record in | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for AzureDNS.
+azurednsHere is an example bash command using the AzureDNS provider:
+### Using client secret
+AZURE_CLIENT_ID=<your service principal client ID> \
+AZURE_TENANT_ID=<your service principal tenant ID> \
+AZURE_CLIENT_SECRET=<your service principal client secret> \
+lego --domains example.com --email your_example@email.com --dns azuredns run
+
+### Using client certificate
+AZURE_CLIENT_ID=<your service principal client ID> \
+AZURE_TENANT_ID=<your service principal tenant ID> \
+AZURE_CLIENT_CERTIFICATE_PATH=<your service principal certificate path> \
+lego --domains example.com --email your_example@email.com --dns azuredns run
+
+### Using Azure CLI
+az login \
+lego --domains example.com --email your_example@email.com --dns azuredns run
+| Environment Variable Name | +Description | +
|---|---|
AZURE_CLIENT_ID |
+Client ID | +
AZURE_CLIENT_SECRET |
+Client secret | +
AZURE_RESOURCE_GROUP |
+DNS zone resource group | +
AZURE_SUBSCRIPTION_ID |
+DNS zone subscription ID | +
AZURE_TENANT_ID |
+Tenant ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AZURE_ENVIRONMENT |
+Azure environment, one of: public, usgovernment, and china | +
AZURE_POLLING_INTERVAL |
+Time between DNS propagation check | +
AZURE_PRIVATE_ZONE |
+Set to true to use Azure Private DNS Zones and not public | +
AZURE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
AZURE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
AZURE_ZONE_NAME |
+Zone name to use inside Azure DNS service to add the TXT record in | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Azure Credentials are automatically detected in the following locations and prioritized in the following order:
+AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRETAZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_CERTIFICATE_PATH~/.azure), used by Azure CLILink:
+ +Azure managed identity service allows linking Azure AD identities to Azure resources.
+Workloads running inside compute typed resource can inherit from this configuration to get rights on Azure resources.
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials.
+This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand. \
Here is a summary of the steps to follow to use it :
+ServiceAccount resource, add following annotations to reference the targeted Azure AD application registration : azure.workload.identity/client-id and azure.workload.identity/tenant-id. \Deployment resource you must reference the previous ServiceAccount and add the following label : azure.workload.identity/use: "true".Kubernetes accessing Azure resources, add the cluster issuer URL and add the namespace and name of your kubernetes service account.Link :
+ +Configuration for Bindman.
+bindmanHere is an example bash command using the Bindman provider:
+BINDMAN_MANAGER_ADDRESS=<your bindman manager address> \
+lego --email you@example.com --dns bindman --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
BINDMAN_MANAGER_ADDRESS |
+The server URL, should have scheme, hostname, and port (if required) of the Bindman-DNS Manager server | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
BINDMAN_HTTP_TIMEOUT |
+API request timeout | +
BINDMAN_POLLING_INTERVAL |
+Time between DNS propagation check | +
BINDMAN_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Bluecat.
+bluecatHere is an example bash command using the Bluecat provider:
+BLUECAT_PASSWORD=mypassword \
+BLUECAT_DNS_VIEW=myview \
+BLUECAT_USER_NAME=myusername \
+BLUECAT_CONFIG_NAME=myconfig \
+BLUECAT_SERVER_URL=https://bam.example.com \
+BLUECAT_TTL=30 \
+lego --email you@example.com --dns bluecat --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
BLUECAT_CONFIG_NAME |
+Configuration name | +
BLUECAT_DNS_VIEW |
+External DNS View Name | +
BLUECAT_PASSWORD |
+API password | +
BLUECAT_SERVER_URL |
+The server URL, should have scheme, hostname, and port (if required) of the authoritative Bluecat BAM serve | +
BLUECAT_USER_NAME |
+API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
BLUECAT_HTTP_TIMEOUT |
+API request timeout | +
BLUECAT_POLLING_INTERVAL |
+Time between DNS propagation check | +
BLUECAT_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
BLUECAT_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Brandit.
+branditHere is an example bash command using the Brandit provider:
+BRANDIT_API_KEY=xxxxxxxxxxxxxxxxxxxxx \
+BRANDIT_API_USERNAME=yyyyyyyyyyyyyyyyyyyy \
+lego --email myemail@example.com --dns brandit --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
BRANDIT_API_KEY |
+The API key | +
BRANDIT_API_USERNAME |
+The API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
BRANDIT_HTTP_TIMEOUT |
+API request timeout | +
BRANDIT_POLLING_INTERVAL |
+Time between DNS propagation check | +
BRANDIT_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
BRANDIT_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Bunny.
+bunnyHere is an example bash command using the Bunny provider:
+BUNNY_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
+lego --email you@example.com --dns bunny --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
BUNNY_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
BUNNY_POLLING_INTERVAL |
+Time between DNS propagation check | +
BUNNY_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
BUNNY_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Checkdomain.
+checkdomainHere is an example bash command using the Checkdomain provider:
+CHECKDOMAIN_TOKEN=yoursecrettoken \
+lego --email you@example.com --dns checkdomain --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CHECKDOMAIN_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CHECKDOMAIN_ENDPOINT |
+API endpoint URL, defaults to https://api.checkdomain.de | +
CHECKDOMAIN_HTTP_TIMEOUT |
+API request timeout, defaults to 30 seconds | +
CHECKDOMAIN_POLLING_INTERVAL |
+Time between DNS propagation check | +
CHECKDOMAIN_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CHECKDOMAIN_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Civo.
+civoHere is an example bash command using the Civo provider:
+CIVO_TOKEN=xxxxxx \
+lego --email you@example.com --dns civo --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CIVO_TOKEN |
+Authentication token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CIVO_POLLING_INTERVAL |
+Time between DNS propagation check | +
CIVO_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CIVO_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for CloudDNS.
+clouddnsHere is an example bash command using the CloudDNS provider:
+CLOUDDNS_CLIENT_ID=bLsdFAks23429841238feb177a572aX \
+CLOUDDNS_EMAIL=you@example.com \
+CLOUDDNS_PASSWORD=b9841238feb177a84330f \
+lego --email you@example.com --dns clouddns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CLOUDDNS_CLIENT_ID |
+Client ID | +
CLOUDDNS_EMAIL |
+Account email | +
CLOUDDNS_PASSWORD |
+Account password | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CLOUDDNS_HTTP_TIMEOUT |
+API request timeout | +
CLOUDDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
CLOUDDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CLOUDDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Cloudflare.
+cloudflareHere is an example bash command using the Cloudflare provider:
+CLOUDFLARE_EMAIL=you@example.com \
+CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
+lego --email you@example.com --dns cloudflare --domains my.example.org run
+
+# or
+
+CLOUDFLARE_DNS_API_TOKEN=1234567890abcdefghijklmnopqrstuvwxyz \
+lego --email you@example.com --dns cloudflare --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CF_API_EMAIL |
+Account email | +
CF_API_KEY |
+API key | +
CF_DNS_API_TOKEN |
+API token with DNS:Edit permission (since v3.1.0) | +
CF_ZONE_API_TOKEN |
+API token with Zone:Read permission (since v3.1.0) | +
CLOUDFLARE_API_KEY |
+Alias to CF_API_KEY | +
CLOUDFLARE_DNS_API_TOKEN |
+Alias to CF_DNS_API_TOKEN | +
CLOUDFLARE_EMAIL |
+Alias to CF_API_EMAIL | +
CLOUDFLARE_ZONE_API_TOKEN |
+Alias to CF_ZONE_API_TOKEN | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CLOUDFLARE_HTTP_TIMEOUT |
+API request timeout | +
CLOUDFLARE_POLLING_INTERVAL |
+Time between DNS propagation check | +
CLOUDFLARE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CLOUDFLARE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
You may use CF_API_EMAIL and CF_API_KEY to authenticate, or CF_DNS_API_TOKEN, or CF_DNS_API_TOKEN and CF_ZONE_API_TOKEN.
If using API keys (CF_API_EMAIL and CF_API_KEY), the Global API Key needs to be used, not the Origin CA Key.
Please be aware, that this in principle allows Lego to read and change everything related to this account.
+With API tokens (CF_DNS_API_TOKEN, and optionally CF_ZONE_API_TOKEN),
+very specific access can be granted to your resources at Cloudflare.
+See this Cloudflare announcement for details.
The main resources Lego cares for are the DNS entries for your Zones. +It also need to resolve a domain name to an internal Zone ID in order to manipulate DNS entries.
+Hence, you should create an API token with the following permissions:
+You also need to scope the access to all your domains for this to work.
+Then pass the API token as CF_DNS_API_TOKEN to Lego.
Alternatively, if you prefer a more strict set of privileges, +you can split the access tokens:
+CF_ZONE_API_TOKEN to Lego.CF_DNS_API_TOKEN to Lego.This “paranoid” setup is mainly interesting for users who manage many zones/domains with a single Cloudflare account. +It follows the principle of least privilege and limits the possible damage, should one of the hosts become compromised.
+Configuration for ClouDNS.
+cloudnsHere is an example bash command using the ClouDNS provider:
+CLOUDNS_AUTH_ID=xxxx \
+CLOUDNS_AUTH_PASSWORD=yyyy \
+lego --email you@example.com --dns cloudns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CLOUDNS_AUTH_ID |
+The API user ID | +
CLOUDNS_AUTH_PASSWORD |
+The password for API user ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CLOUDNS_HTTP_TIMEOUT |
+API request timeout | +
CLOUDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
CLOUDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CLOUDNS_SUB_AUTH_ID |
+The API sub user ID | +
CLOUDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for CloudXNS.
+cloudxnsHere is an example bash command using the CloudXNS provider:
+CLOUDXNS_API_KEY=xxxx \
+CLOUDXNS_SECRET_KEY=yyyy \
+lego --email you@example.com --dns cloudxns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CLOUDXNS_API_KEY |
+The API key | +
CLOUDXNS_SECRET_KEY |
+The API secret key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CLOUDXNS_HTTP_TIMEOUT |
+API request timeout | +
CLOUDXNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
CLOUDXNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CLOUDXNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for ConoHa.
+conohaHere is an example bash command using the ConoHa provider:
+CONOHA_TENANT_ID=487727e3921d44e3bfe7ebb337bf085e \
+CONOHA_API_USERNAME=xxxx \
+CONOHA_API_PASSWORD=yyyy \
+lego --email you@example.com --dns conoha --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CONOHA_API_PASSWORD |
+The API password | +
CONOHA_API_USERNAME |
+The API username | +
CONOHA_TENANT_ID |
+Tenant ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CONOHA_HTTP_TIMEOUT |
+API request timeout | +
CONOHA_POLLING_INTERVAL |
+Time between DNS propagation check | +
CONOHA_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CONOHA_REGION |
+The region | +
CONOHA_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Constellix.
+constellixHere is an example bash command using the Constellix provider:
+CONSTELLIX_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
+CONSTELLIX_SECRET_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
+lego --email you@example.com --dns constellix --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
CONSTELLIX_API_KEY |
+User API key | +
CONSTELLIX_SECRET_KEY |
+User secret key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
CONSTELLIX_HTTP_TIMEOUT |
+API request timeout | +
CONSTELLIX_POLLING_INTERVAL |
+Time between DNS propagation check | +
CONSTELLIX_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
CONSTELLIX_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Derak Cloud.
+derakHere is an example bash command using the Derak Cloud provider:
+DERAK_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
+lego --email myemail@example.com --dns derak --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DERAK_API_KEY |
+The API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DERAK_HTTP_TIMEOUT |
+API request timeout | +
DERAK_POLLING_INTERVAL |
+Time between DNS propagation check | +
DERAK_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DERAK_TTL |
+The TTL of the TXT record used for the DNS challenge | +
DERAK_WEBSITE_ID |
+Force the zone/website ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for deSEC.io.
+desecHere is an example bash command using the deSEC.io provider:
+DESEC_TOKEN=x-xxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns desec --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DESEC_TOKEN |
+Domain token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DESEC_HTTP_TIMEOUT |
+API request timeout | +
DESEC_POLLING_INTERVAL |
+Time between DNS propagation check | +
DESEC_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DESEC_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Designate DNSaaS for Openstack.
+designateHere is an example bash command using the Designate DNSaaS for Openstack provider:
+# With a `clouds.yaml`
+OS_CLOUD=my_openstack \
+lego --email you@example.com --dns designate --domains my.example.org run
+
+# or
+
+OS_AUTH_URL=https://openstack.example.org \
+OS_REGION_NAME=RegionOne \
+OS_PROJECT_ID=23d4522a987d4ab529f722a007c27846
+OS_USERNAME=myuser \
+OS_PASSWORD=passw0rd \
+lego --email you@example.com --dns designate --domains my.example.org run
+
+# or
+
+OS_AUTH_URL=https://openstack.example.org \
+OS_REGION_NAME=RegionOne \
+OS_AUTH_TYPE=v3applicationcredential \
+OS_APPLICATION_CREDENTIAL_ID=imn74uq0or7dyzz20dwo1ytls4me8dry \
+OS_APPLICATION_CREDENTIAL_SECRET=68FuSPSdQqkFQYH5X1OoriEIJOwyLtQ8QSqXZOc9XxFK1A9tzZT6He2PfPw0OMja \
+lego --email you@example.com --dns designate --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
OS_APPLICATION_CREDENTIAL_ID |
+Application credential ID | +
OS_APPLICATION_CREDENTIAL_NAME |
+Application credential name | +
OS_APPLICATION_CREDENTIAL_SECRET |
+Application credential secret | +
OS_AUTH_URL |
+Identity endpoint URL | +
OS_PASSWORD |
+Password | +
OS_PROJECT_NAME |
+Project name | +
OS_REGION_NAME |
+Region name | +
OS_USERNAME |
+Username | +
OS_USER_ID |
+User ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DESIGNATE_POLLING_INTERVAL |
+Time between DNS propagation check | +
DESIGNATE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DESIGNATE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
OS_PROJECT_ID |
+Project ID | +
OS_TENANT_NAME |
+Tenant name (deprecated see OS_PROJECT_NAME and OS_PROJECT_ID) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
There are three main ways of authenticating with Designate:
+OS_CLOUD environment variable and a clouds.yaml file.OS_USERNAME, OS_PASSWORD and OS_PROJECT_NAME environment variables.OS_APPLICATION_CREDENTIAL_* and OS_USER_ID environment variables.For the username/password and application methods, the OS_AUTH_URL and OS_REGION_NAME environment variables are required.
For more information, you can read about the different methods of authentication with OpenStack in the Keystone’s documentation and the gophercloud documentation:
+ +Configuration for Digital Ocean.
+digitaloceanHere is an example bash command using the Digital Ocean provider:
+DO_AUTH_TOKEN=xxxxxx \
+lego --email you@example.com --dns digitalocean --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DO_AUTH_TOKEN |
+Authentication token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DO_API_URL |
+The URL of the API | +
DO_HTTP_TIMEOUT |
+API request timeout | +
DO_POLLING_INTERVAL |
+Time between DNS propagation check | +
DO_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DO_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for dnsHome.de.
+dnshomedeHere is an example bash command using the dnsHome.de provider:
+DNSHOMEDE_CREDENTIALS=sub.example.org:password \
+lego --email you@example.com --dns dnshomede --domains example.org --domains '*.example.org' run
+
+DNSHOMEDE_CREDENTIALS=my.example.org:password1,demo.example.org:password2 \
+lego --email you@example.com --dns dnshomede --domains my.example.org --domains demo.example.org
+| Environment Variable Name | +Description | +
|---|---|
DNSHOMEDE_CREDENTIALS |
+Comma-separated list of domain:password credential pairs | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for DNSimple.
+dnsimpleHere is an example bash command using the DNSimple provider:
+DNSIMPLE_OAUTH_TOKEN=1234567890abcdefghijklmnopqrstuvwxyz \
+lego --email you@example.com --dns dnsimple --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DNSIMPLE_OAUTH_TOKEN |
+OAuth token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DNSIMPLE_BASE_URL |
+API endpoint URL | +
DNSIMPLE_POLLING_INTERVAL |
+Time between DNS propagation check | +
DNSIMPLE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DNSIMPLE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
DNSIMPLE_BASE_URL is optional and must be set to production (https://api.dnsimple.com).
+if DNSIMPLE_BASE_URL is not defined or empty, the production URL is used by default.
While you can manage DNS records in the DNSimple Sandbox environment, +DNS records will not resolve and you will not be able to satisfy the ACME DNS challenge.
+To authenticate you need to provide a valid API token. +HTTP Basic Authentication is intentionally not supported.
+You can generate a new API token from your account page. +Only Account API tokens are supported, if you try to use an User API token you will receive an error message.
+Configuration for DNS Made Easy.
+dnsmadeeasyHere is an example bash command using the DNS Made Easy provider:
+DNSMADEEASY_API_KEY=xxxxxx \
+DNSMADEEASY_API_SECRET=yyyyy \
+lego --email you@example.com --dns dnsmadeeasy --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DNSMADEEASY_API_KEY |
+The API key | +
DNSMADEEASY_API_SECRET |
+The API Secret key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DNSMADEEASY_HTTP_TIMEOUT |
+API request timeout | +
DNSMADEEASY_POLLING_INTERVAL |
+Time between DNS propagation check | +
DNSMADEEASY_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DNSMADEEASY_SANDBOX |
+Activate the sandbox (boolean) | +
DNSMADEEASY_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Use the Tencent Cloud provider instead.
+dnspodHere is an example bash command using the DNSPod (deprecated) provider:
+DNSPOD_API_KEY=xxxxxx \
+lego --email you@example.com --dns dnspod --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DNSPOD_API_KEY |
+The user token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DNSPOD_HTTP_TIMEOUT |
+API request timeout | +
DNSPOD_POLLING_INTERVAL |
+Time between DNS propagation check | +
DNSPOD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DNSPOD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Domain Offensive (do.de).
+dodeHere is an example bash command using the Domain Offensive (do.de) provider:
+DODE_TOKEN=xxxxxx \
+lego --email you@example.com --dns dode --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DODE_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DODE_HTTP_TIMEOUT |
+API request timeout | +
DODE_POLLING_INTERVAL |
+Time between DNS propagation check | +
DODE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DODE_SEQUENCE_INTERVAL |
+Time between sequential requests | +
DODE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Domeneshop.
+domeneshopHere is an example bash command using the Domeneshop provider:
+DOMENESHOP_API_TOKEN=<token> \
+DOMENESHOP_API_SECRET=<secret> \
+lego --email example@example.com --dns domeneshop --domains example.com run
+| Environment Variable Name | +Description | +
|---|---|
DOMENESHOP_API_SECRET |
+API secret | +
DOMENESHOP_API_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DOMENESHOP_HTTP_TIMEOUT |
+API request timeout | +
DOMENESHOP_POLLING_INTERVAL |
+Time between DNS propagation check | +
DOMENESHOP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Visit the following page for information on how to create API credentials with Domeneshop:
+https://api.domeneshop.no/docs/#section/Authentication
+Configuration for DreamHost.
+dreamhostHere is an example bash command using the DreamHost provider:
+DREAMHOST_API_KEY="YOURAPIKEY" \
+lego --email you@example.com --dns dreamhost --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DREAMHOST_API_KEY |
+The API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DREAMHOST_HTTP_TIMEOUT |
+API request timeout | +
DREAMHOST_POLLING_INTERVAL |
+Time between DNS propagation check | +
DREAMHOST_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DREAMHOST_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Duck DNS.
+duckdnsHere is an example bash command using the Duck DNS provider:
+DUCKDNS_TOKEN=xxxxxx \
+lego --email you@example.com --dns duckdns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DUCKDNS_TOKEN |
+Account token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DUCKDNS_HTTP_TIMEOUT |
+API request timeout | +
DUCKDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
DUCKDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DUCKDNS_SEQUENCE_INTERVAL |
+Time between sequential requests | +
DUCKDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Dyn.
+dynHere is an example bash command using the Dyn provider:
+DYN_CUSTOMER_NAME=xxxxxx \
+DYN_USER_NAME=yyyyy \
+DYN_PASSWORD=zzzz \
+lego --email you@example.com --dns dyn --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DYN_CUSTOMER_NAME |
+Customer name | +
DYN_PASSWORD |
+Password | +
DYN_USER_NAME |
+User name | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DYN_HTTP_TIMEOUT |
+API request timeout | +
DYN_POLLING_INTERVAL |
+Time between DNS propagation check | +
DYN_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DYN_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Dynu.
+dynuHere is an example bash command using the Dynu provider:
+DYNU_API_KEY=1234567890abcdefghijklmnopqrstuvwxyz \
+lego --email you@example.com --dns dynu --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
DYNU_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DYNU_HTTP_TIMEOUT |
+API request timeout | +
DYNU_POLLING_INTERVAL |
+Time between DNS propagation check | +
DYNU_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
DYNU_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for EasyDNS.
+easydnsHere is an example bash command using the EasyDNS provider:
+EASYDNS_TOKEN=<your token> \
+EASYDNS_KEY=<your key> \
+lego --email you@example.com --dns easydns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
EASYDNS_KEY |
+API Key | +
EASYDNS_TOKEN |
+API Token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
EASYDNS_ENDPOINT |
+The endpoint URL of the API Server | +
EASYDNS_HTTP_TIMEOUT |
+API request timeout | +
EASYDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
EASYDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
EASYDNS_SEQUENCE_INTERVAL |
+Time between sequential requests | +
EASYDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
To test with the sandbox environment set EASYDNS_ENDPOINT=https://sandbox.rest.easydns.net
Akamai edgedns supersedes FastDNS; implementing a DNS provider for solving the DNS-01 challenge using Akamai EdgeDNS
+edgednsHere is an example bash command using the Akamai EdgeDNS provider:
+AKAMAI_CLIENT_SECRET=abcdefghijklmnopqrstuvwxyz1234567890ABCDEFG= \
+AKAMAI_CLIENT_TOKEN=akab-mnbvcxzlkjhgfdsapoiuytrewq1234567 \
+AKAMAI_HOST=akab-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.luna.akamaiapis.net \
+AKAMAI_ACCESS_TOKEN=akab-1234567890qwerty-asdfghjklzxcvtnu \
+lego --email you@example.com --dns edgedns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
AKAMAI_ACCESS_TOKEN |
+Access token, managed by the Akamai EdgeGrid client | +
AKAMAI_CLIENT_SECRET |
+Client secret, managed by the Akamai EdgeGrid client | +
AKAMAI_CLIENT_TOKEN |
+Client token, managed by the Akamai EdgeGrid client | +
AKAMAI_EDGERC |
+Path to the .edgerc file, managed by the Akamai EdgeGrid client | +
AKAMAI_EDGERC_SECTION |
+Configuration section, managed by the Akamai EdgeGrid client | +
AKAMAI_HOST |
+API host, managed by the Akamai EdgeGrid client | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AKAMAI_POLLING_INTERVAL |
+Time between DNS propagation check. Default: 15 seconds | +
AKAMAI_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation. Default: 3 minutes | +
AKAMAI_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Akamai credentials are automatically detected in the following locations and prioritized in the following order:
+{SECTION} is specified using AKAMAI_EDGERC_SECTION):AKAMAI_{SECTION}_HOSTAKAMAI_{SECTION}_ACCESS_TOKENAKAMAI_{SECTION}_CLIENT_TOKENAKAMAI_{SECTION}_CLIENT_SECRETAKAMAI_EDGERC_SECTION is not defined or is set to default, environment variables:AKAMAI_HOSTAKAMAI_ACCESS_TOKENAKAMAI_CLIENT_TOKENAKAMAI_CLIENT_SECRET.edgerc file located at AKAMAI_EDGERC~/.edgerc, sections can be specified using AKAMAI_EDGERC_SECTIONAKAMAI_HOSTAKAMAI_ACCESS_TOKENAKAMAI_CLIENT_TOKENAKAMAI_CLIENT_SECRETSee also:
+ +Configuration for Efficient IP.
+efficientipHere is an example bash command using the Efficient IP provider:
+EFFICIENTIP_USERNAME="user" \
+EFFICIENTIP_PASSWORD="secret" \
+EFFICIENTIP_HOSTNAME="ipam.example.org" \
+EFFICIENTIP_DNS_NAME="dns.smart" \
+lego --email you@example.com --dns efficientip --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
EFFICIENTIP_DNS_NAME |
+DNS name (ex: dns.smart) | +
EFFICIENTIP_HOSTNAME |
+Hostname (ex: foo.example.com) | +
EFFICIENTIP_PASSWORD |
+Password | +
EFFICIENTIP_USERNAME |
+Username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
EFFICIENTIP_HTTP_TIMEOUT |
+API request timeout | +
EFFICIENTIP_POLLING_INTERVAL |
+Time between DNS propagation check | +
EFFICIENTIP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
EFFICIENTIP_TTL |
+The TTL of the TXT record used for the DNS challenge | +
EFFICIENTIP_VIEW_NAME |
+View name (ex: external) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Epik.
+epikHere is an example bash command using the Epik provider:
+EPIK_SIGNATURE=xxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns epik --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
EPIK_SIGNATURE |
+Epik API signature (https://registrar.epik.com/account/api-settings/) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
EPIK_HTTP_TIMEOUT |
+API request timeout | +
EPIK_POLLING_INTERVAL |
+Time between DNS propagation check | +
EPIK_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
EPIK_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Solving the DNS-01 challenge using an external program.
+execHere is an example bash command using the External program provider:
+EXEC_PATH=/the/path/to/myscript.sh \
+lego --email you@example.com --dns exec --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
EXEC_MODE |
+RAW, none |
+
EXEC_PATH |
+The path of the the external program. | +
| Environment Variable Name | +Description | +
|---|---|
EXEC_POLLING_INTERVAL |
+Time between DNS propagation check. | +
EXEC_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation. | +
EXEC_SEQUENCE_INTERVAL |
+Time between sequential requests. | +
The file name of the external program is specified in the environment variable EXEC_PATH.
When it is run by lego, three command-line parameters are passed to it: +The action (“present” or “cleanup”), the fully-qualified domain name and the value for the record.
+For example, requesting a certificate for the domain ‘my.example.org’ can be achieved by calling lego as follows:
+EXEC_PATH=./update-dns.sh \
+ lego --email you@example.com \
+ --dns exec \
+ --domains my.example.org run
+It will then call the program ‘./update-dns.sh’ with like this:
+./update-dns.sh "present" "_acme-challenge.my.example.org." "MsijOYZxqyjGnFGwhjrhfg-Xgbl5r68WPda0J9EgqqI"
+The program then needs to make sure the record is inserted. +When it returns an error via a non-zero exit code, lego aborts.
+When the record is to be removed again,
+the program is called with the first command-line parameter set to cleanup instead of present.
If you want to use the raw domain, token, and keyAuth values with your program, you can set EXEC_MODE=RAW:
EXEC_MODE=RAW \
+EXEC_PATH=./update-dns.sh \
+ lego --email you@example.com \
+ --dns exec \
+ --domains my.example.org run
+It will then call the program ./update-dns.sh like this:
./update-dns.sh "present" "my.example.org." "--" "some-token" "KxAy-J3NwUmg9ZQuM-gP_Mq1nStaYSaP9tYQs5_-YsE.ksT-qywTd8058G-SHHWA3RAN72Pr0yWtPYmmY5UBpQ8"
+The -- is because the token MAY start with a -, and the called program may try and interpret a - as indicating a flag.
+In the case of urfave, which is commonly used,
+you can use the -- delimiter to specify the start of positional arguments, and handle such a string safely.
| Mode | +Command | +
|---|---|
| default | +myprogram present -- <FQDN> <record> |
+
RAW |
+myprogram present -- <domain> <token> <key_auth> |
+
| Mode | +Command | +
|---|---|
| default | +myprogram cleanup -- <FQDN> <record> |
+
RAW |
+myprogram cleanup -- <domain> <token> <key_auth> |
+
Configuration for Exoscale.
+exoscaleHere is an example bash command using the Exoscale provider:
+EXOSCALE_API_KEY=abcdefghijklmnopqrstuvwx \
+EXOSCALE_API_SECRET=xxxxxxx \
+lego --email you@example.com --dns exoscale --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
EXOSCALE_API_KEY |
+API key | +
EXOSCALE_API_SECRET |
+API secret | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
EXOSCALE_API_ZONE |
+API zone | +
EXOSCALE_ENDPOINT |
+API endpoint URL | +
EXOSCALE_HTTP_TIMEOUT |
+API request timeout | +
EXOSCALE_POLLING_INTERVAL |
+Time between DNS propagation check | +
EXOSCALE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
EXOSCALE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for freemyip.com.
+freemyipHere is an example bash command using the freemyip.com provider:
+FREEMYIP_TOKEN=xxxxxx \
+lego --email you@example.com --dns freemyip --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
FREEMYIP_TOKEN |
+Account token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
FREEMYIP_HTTP_TIMEOUT |
+API request timeout | +
FREEMYIP_POLLING_INTERVAL |
+Time between DNS propagation check | +
FREEMYIP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
FREEMYIP_SEQUENCE_INTERVAL |
+Time between sequential requests | +
FREEMYIP_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Gandi.
+gandiHere is an example bash command using the Gandi provider:
+GANDI_API_KEY=abcdefghijklmnopqrstuvwx \
+lego --email you@example.com --dns gandi --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
GANDI_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GANDI_HTTP_TIMEOUT |
+API request timeout | +
GANDI_POLLING_INTERVAL |
+Time between DNS propagation check | +
GANDI_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
GANDI_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Gandi Live DNS (v5).
+gandiv5Here is an example bash command using the Gandi Live DNS (v5) provider:
+GANDIV5_API_KEY=abcdefghijklmnopqrstuvwx \
+lego --email you@example.com --dns gandiv5 --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
GANDIV5_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GANDIV5_HTTP_TIMEOUT |
+API request timeout | +
GANDIV5_POLLING_INTERVAL |
+Time between DNS propagation check | +
GANDIV5_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
GANDIV5_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Google Cloud.
+gcloudHere is an example bash command using the Google Cloud provider:
+GCE_PROJECT="gc-project-id" GCE_SERVICE_ACCOUNT_FILE="/path/to/svc/account/file.json" lego \
+ --email="abc@email.com" \
+ --domains="example.com" \
+ --dns="gcloud" \
+ --path="${HOME}/.lego" \
+ run
+| Environment Variable Name | +Description | +
|---|---|
Application Default Credentials |
+Documentation | +
GCE_PROJECT |
+Project name (by default, the project name is auto-detected by using the metadata service) | +
GCE_SERVICE_ACCOUNT |
+Account | +
GCE_SERVICE_ACCOUNT_FILE |
+Account file path | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GCE_ALLOW_PRIVATE_ZONE |
+Allows requested domain to be in private DNS zone, works only with a private ACME server (by default: false) | +
GCE_POLLING_INTERVAL |
+Time between DNS propagation check | +
GCE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
GCE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for G-Core Labs.
+gcoreHere is an example bash command using the G-Core Labs provider:
+GCORE_PERMANENT_API_TOKEN=xxxxx \
+lego --email you@example.com --dns gcore --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
GCORE_PERMANENT_API_TOKEN |
+Permanent API tokene (https://gcorelabs.com/blog/permanent-api-token-explained/) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GCORE_HTTP_TIMEOUT |
+API request timeout | +
GCORE_POLLING_INTERVAL |
+Time between DNS propagation check | +
GCORE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
GCORE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Glesys.
+glesysHere is an example bash command using the Glesys provider:
+GLESYS_API_USER=xxxxx \
+GLESYS_API_KEY=yyyyy \
+lego --email you@example.com --dns glesys --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
GLESYS_API_KEY |
+API key | +
GLESYS_API_USER |
+API user | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GLESYS_HTTP_TIMEOUT |
+API request timeout | +
GLESYS_POLLING_INTERVAL |
+Time between DNS propagation check | +
GLESYS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
GLESYS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Go Daddy.
+godaddyHere is an example bash command using the Go Daddy provider:
+GODADDY_API_KEY=xxxxxxxx \
+GODADDY_API_SECRET=yyyyyyyy \
+lego --email you@example.com --dns godaddy --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
GODADDY_API_KEY |
+API key | +
GODADDY_API_SECRET |
+API secret | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GODADDY_HTTP_TIMEOUT |
+API request timeout | +
GODADDY_POLLING_INTERVAL |
+Time between DNS propagation check | +
GODADDY_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
GODADDY_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Google Domains.
+googledomainsHere is an example bash command using the Google Domains provider:
+GOOGLE_DOMAINS_ACCESS_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns googledomains --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
GOOGLE_DOMAINS_ACCESS_TOKEN |
+Access token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
GOOGLE_DOMAINS_HTTP_TIMEOUT |
+API request timeout | +
GOOGLE_DOMAINS_POLLING_INTERVAL |
+Time between DNS propagation check | +
GOOGLE_DOMAINS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Hetzner.
+hetznerHere is an example bash command using the Hetzner provider:
+HETZNER_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
+lego --email you@example.com --dns hetzner --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
HETZNER_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
HETZNER_HTTP_TIMEOUT |
+API request timeout | +
HETZNER_POLLING_INTERVAL |
+Time between DNS propagation check | +
HETZNER_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
HETZNER_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Hosting.de.
+hostingdeHere is an example bash command using the Hosting.de provider:
+HOSTINGDE_API_KEY=xxxxxxxx \
+lego --email you@example.com --dns hostingde --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
HOSTINGDE_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
HOSTINGDE_HTTP_TIMEOUT |
+API request timeout | +
HOSTINGDE_POLLING_INTERVAL |
+Time between DNS propagation check | +
HOSTINGDE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
HOSTINGDE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
HOSTINGDE_ZONE_NAME |
+Zone name in ACE format | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Hosttech.
+hosttechHere is an example bash command using the Hosttech provider:
+HOSTTECH_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns hosttech --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
HOSTTECH_API_KEY |
+API login | +
HOSTTECH_PASSWORD |
+API password | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
HOSTTECH_HTTP_TIMEOUT |
+API request timeout | +
HOSTTECH_POLLING_INTERVAL |
+Time between DNS propagation check | +
HOSTTECH_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
HOSTTECH_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for HTTP request.
+httpreqHere is an example bash command using the HTTP request provider:
+HTTPREQ_ENDPOINT=http://my.server.com:9090 \
+lego --email you@example.com --dns httpreq --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
HTTPREQ_ENDPOINT |
+The URL of the server | +
HTTPREQ_MODE |
+RAW, none |
+
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
HTTPREQ_HTTP_TIMEOUT |
+API request timeout | +
HTTPREQ_PASSWORD |
+Basic authentication password | +
HTTPREQ_POLLING_INTERVAL |
+Time between DNS propagation check | +
HTTPREQ_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
HTTPREQ_USERNAME |
+Basic authentication username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
The server must provide:
+POST /presentPOST /cleanupThe URL of the server must be define by HTTPREQ_ENDPOINT.
There are 2 modes (HTTPREQ_MODE):
{
+ "fqdn": "_acme-challenge.domain.",
+ "value": "LHDhK3oGRvkiefQnx7OOczTY5Tic_xZ6HcMOc_gmtoM"
+}
+RAW{
+ "domain": "domain",
+ "token": "token",
+ "keyAuth": "key"
+}
+Basic authentication (optional) can be set with some environment variables:
+HTTPREQ_USERNAME and HTTPREQ_PASSWORDConfiguration for Hurricane Electric DNS.
+hurricaneHere is an example bash command using the Hurricane Electric DNS provider:
+HURRICANE_TOKENS=example.org:token \
+lego --email you@example.com --dns hurricane --domains example.org --domains '*.example.org' run
+
+HURRICANE_TOKENS=my.example.org:token1,demo.example.org:token2 \
+lego --email you@example.com --dns hurricane --domains my.example.org --domains demo.example.org
+| Environment Variable Name | +Description | +
|---|---|
HURRICANE_TOKENS |
+TXT record names and tokens | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Before using lego to request a certificate for a given domain or wildcard (such as my.example.org or *.my.example.org),
+create a TXT record named _acme-challenge.my.example.org, and enable dynamic updates on it.
+Generate a token for each URL with Hurricane Electric’s UI, and copy it down.
+Stick to alphanumeric tokens for greatest reliability.
To authenticate with the Hurricane Electric API,
+add each record name/token pair you want to update to the HURRICANE_TOKENS environment variable, as shown in the examples.
+Record names (without the _acme-challenge. component) and their tokens are separated with colons,
+while the credential pairs are concatenated into a comma-separated list, like so:
HURRICANE_TOKENS=my.example.org:token1,demo.example.org:token2
+If you are issuing both a wildcard certificate and a standard certificate for a given subdomain, +you should not have repeat entries for that name, as both will use the same credential.
+HURRICANE_TOKENS=example.org:token
+Configuration for HyperOne.
+hyperoneHere is an example bash command using the HyperOne provider:
+lego --email you@example.com --dns hyperone --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
HYPERONE_API_URL |
+Allows to pass custom API Endpoint to be used in the challenge (default https://api.hyperone.com/v2) | +
HYPERONE_LOCATION_ID |
+Specifies location (region) to be used in API calls. (default pl-waw-1) | +
HYPERONE_PASSPORT_LOCATION |
+Allows to pass custom passport file location (default ~/.h1/passport.json) | +
HYPERONE_POLLING_INTERVAL |
+Time between DNS propagation check | +
HYPERONE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
HYPERONE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Default configuration does not require any additional environment variables,
+just a passport file in ~/.h1/passport.json location.
To use this application you have to generate passport file for sa:
h1 iam project sa credential generate --name my-passport --project <project ID> --sa <sa ID> --passport-output-file ~/.h1/passport.json
+The application requires following permissions:
+dns/zone/listdns/zone.recordset/listdns/zone.recordset/createdns/zone.recordset/deletedns/zone.record/createdns/zone.record/listdns/zone.record/deleteAll required permissions are available via platform role tool.lego.
Configuration for IBM Cloud (SoftLayer).
+ibmcloudHere is an example bash command using the IBM Cloud (SoftLayer) provider:
+SOFTLAYER_USERNAME=xxxxx \
+SOFTLAYER_API_KEY=yyyyy \
+lego --email you@example.com --dns ibmcloud --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SOFTLAYER_API_KEY |
+Classic Infrastructure API key | +
SOFTLAYER_USERNAME |
+User name (IBM Cloud is _) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SOFTLAYER_POLLING_INTERVAL |
+Time between DNS propagation check | +
SOFTLAYER_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SOFTLAYER_TIMEOUT |
+API request timeout | +
SOFTLAYER_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Internet Initiative Japan.
+iijHere is an example bash command using the Internet Initiative Japan provider:
+IIJ_API_ACCESS_KEY=xxxxxxxx \
+IIJ_API_SECRET_KEY=yyyyyy \
+IIJ_DO_SERVICE_CODE=zzzzzz \
+lego --email you@example.com --dns iij --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
IIJ_API_ACCESS_KEY |
+API access key | +
IIJ_API_SECRET_KEY |
+API secret key | +
IIJ_DO_SERVICE_CODE |
+DO service code | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
IIJ_POLLING_INTERVAL |
+Time between DNS propagation check | +
IIJ_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
IIJ_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for IIJ DNS Platform Service.
+iijdpfHere is an example bash command using the IIJ DNS Platform Service provider:
+IIJ_DPF_API_TOKEN=xxxxxxxx \
+IIJ_DPF_DPM_SERVICE_CODE=yyyyyy \
+lego --email you@example.com --dns iijdpf --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
IIJ_DPF_API_TOKEN |
+API token | +
IIJ_DPF_DPM_SERVICE_CODE |
+IIJ Managed DNS Service’s service code | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
IIJ_DPF_API_ENDPOINT |
+API endpoint URL, defaults to https://api.dns-platform.jp/dpf/v1 | +
IIJ_DPF_POLLING_INTERVAL |
+Time between DNS propagation check, defaults to 5 second | +
IIJ_DPF_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation, defaults to 660 second | +
IIJ_DPF_TTL |
+The TTL of the TXT record used for the DNS challenge, default to 300 | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Credentials and DNS configuration for DNS providers must be passed through environment variables.
+The environment variables can reference a value.
+Here is an example bash command using the Cloudflare DNS provider:
+$ CLOUDFLARE_EMAIL=you@example.com \
+ CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
+ lego --dns cloudflare --domains www.example.com --email you@example.com run
+The environment variables can reference a path to file.
+In this case the name of environment variable must be suffixed by _FILE.
The file must contain only the value.
+Here is an example bash command using the CloudFlare DNS provider:
+$ cat /the/path/to/my/key
+b9841238feb177a84330febba8a83208921177bffe733
+
+$ cat /the/path/to/my/email
+you@example.com
+
+$ CLOUDFLARE_EMAIL_FILE=/the/path/to/my/email \
+ CLOUDFLARE_API_KEY_FILE=/the/path/to/my/key \
+ lego --dns cloudflare --domains www.example.com --email you@example.com run
+| Provider name | +CLI flag name | +Required lego version | +|
|---|---|---|---|
| + Akamai EdgeDNS + | +Website | +
+ edgedns
+ |
+ v3.9.0 | +
| + Alibaba Cloud DNS + | +Website | +
+ alidns
+ |
+ v1.1.0 | +
| + all-inkl + | +Website | +
+ allinkl
+ |
+ v4.5.0 | +
| + Amazon Lightsail + | +Website | +
+ lightsail
+ |
+ v0.5.0 | +
| + Amazon Route 53 + | +Website | +
+ route53
+ |
+ v0.3.0 | +
| + ArvanCloud + | +Website | +
+ arvancloud
+ |
+ v3.8.0 | +
| + Aurora DNS + | +Website | +
+ auroradns
+ |
+ v0.4.0 | +
| + Autodns + | +Website | +
+ autodns
+ |
+ v3.2.0 | +
| + Azure (deprecated) + | +Website | +
+ azure
+ |
+ v0.4.0 | +
| + AzureDNS + | +Website | +
+ azuredns
+ |
+ v0.1.0 | +
| + Bindman + | +Website | +
+ bindman
+ |
+ v2.6.0 | +
| + Bluecat + | +Website | +
+ bluecat
+ |
+ v0.5.0 | +
| + Brandit + | +Website | +
+ brandit
+ |
+ v4.11.0 | +
| + Bunny + | +Website | +
+ bunny
+ |
+ v4.11.0 | +
| + Checkdomain + | +Website | +
+ checkdomain
+ |
+ v3.3.0 | +
| + Civo + | +Website | +
+ civo
+ |
+ v4.9.0 | +
| + CloudDNS + | +Website | +
+ clouddns
+ |
+ v3.6.0 | +
| + Cloudflare + | +Website | +
+ cloudflare
+ |
+ v0.3.0 | +
| + ClouDNS + | +Website | +
+ cloudns
+ |
+ v2.3.0 | +
| + CloudXNS + | +Website | +
+ cloudxns
+ |
+ v0.5.0 | +
| + ConoHa + | +Website | +
+ conoha
+ |
+ v1.2.0 | +
| + Constellix + | +Website | +
+ constellix
+ |
+ v3.4.0 | +
| + Derak Cloud + | +Website | +
+ derak
+ |
+ v4.12.0 | +
| + deSEC.io + | +Website | +
+ desec
+ |
+ v3.7.0 | +
| + Designate DNSaaS for Openstack + | +Website | +
+ designate
+ |
+ v2.2.0 | +
| + Digital Ocean + | +Website | +
+ digitalocean
+ |
+ v0.3.0 | +
| + DNS Made Easy + | +Website | +
+ dnsmadeeasy
+ |
+ v0.4.0 | +
| + dnsHome.de + | +Website | +
+ dnshomede
+ |
+ v4.10.0 | +
| + DNSimple + | +Website | +
+ dnsimple
+ |
+ v0.3.0 | +
| + DNSPod (deprecated) + | +Website | +
+ dnspod
+ |
+ v0.4.0 | +
| + Domain Offensive (do.de) + | +Website | +
+ dode
+ |
+ v2.4.0 | +
| + Domeneshop + | +Website | +
+ domeneshop
+ |
+ v4.3.0 | +
| + DreamHost + | +Website | +
+ dreamhost
+ |
+ v1.1.0 | +
| + Duck DNS + | +Website | +
+ duckdns
+ |
+ v0.5.0 | +
| + Dyn + | +Website | +
+ dyn
+ |
+ v0.3.0 | +
| + Dynu + | +Website | +
+ dynu
+ |
+ v3.5.0 | +
| + EasyDNS + | +Website | +
+ easydns
+ |
+ v2.6.0 | +
| + Efficient IP + | +Website | +
+ efficientip
+ |
+ v4.13.0 | +
| + Epik + | +Website | +
+ epik
+ |
+ v4.5.0 | +
| + Exoscale + | +Website | +
+ exoscale
+ |
+ v0.4.0 | +
| + External program + | +Website | +
+ exec
+ |
+ v0.5.0 | +
| + freemyip.com + | +Website | +
+ freemyip
+ |
+ v4.5.0 | +
| + G-Core Labs + | +Website | +
+ gcore
+ |
+ v4.5.0 | +
| + Gandi + | +Website | +
+ gandi
+ |
+ v0.3.0 | +
| + Gandi Live DNS (v5) + | +Website | +
+ gandiv5
+ |
+ v0.5.0 | +
| + Glesys + | +Website | +
+ glesys
+ |
+ v0.5.0 | +
| + Go Daddy + | +Website | +
+ godaddy
+ |
+ v0.5.0 | +
| + Google Cloud + | +Website | +
+ gcloud
+ |
+ v0.3.0 | +
| + Google Domains + | +Website | +
+ googledomains
+ |
+ v4.11.0 | +
| + Hetzner + | +Website | +
+ hetzner
+ |
+ v3.7.0 | +
| + Hosting.de + | +Website | +
+ hostingde
+ |
+ v1.1.0 | +
| + Hosttech + | +Website | +
+ hosttech
+ |
+ v4.5.0 | +
| + HTTP request + | +Website | +
+ httpreq
+ |
+ v2.0.0 | +
| + Hurricane Electric DNS + | +Website | +
+ hurricane
+ |
+ v4.3.0 | +
| + HyperOne + | +Website | +
+ hyperone
+ |
+ v3.9.0 | +
| + IBM Cloud (SoftLayer) + | +Website | +
+ ibmcloud
+ |
+ v4.5.0 | +
| + IIJ DNS Platform Service + | +Website | +
+ iijdpf
+ |
+ v4.7.0 | +
| + Infoblox + | +Website | +
+ infoblox
+ |
+ v4.4.0 | +
| + Infomaniak + | +Website | +
+ infomaniak
+ |
+ v4.1.0 | +
| + Internet Initiative Japan + | +Website | +
+ iij
+ |
+ v1.1.0 | +
| + Internet.bs + | +Website | +
+ internetbs
+ |
+ v4.5.0 | +
| + INWX + | +Website | +
+ inwx
+ |
+ v2.0.0 | +
| + Ionos + | +Website | +
+ ionos
+ |
+ v4.2.0 | +
| + iwantmyname + | +Website | +
+ iwantmyname
+ |
+ v4.7.0 | +
| + Joker + | +Website | +
+ joker
+ |
+ v2.6.0 | +
| + Joohoi's ACME-DNS + | +Website | +
+ acme-dns
+ |
+ v1.1.0 | +
| + Liara + | +Website | +
+ liara
+ |
+ v4.10.0 | +
| + Linode (v4) + | +Website | +
+ linode
+ |
+ v1.1.0 | +
| + Liquid Web + | +Website | +
+ liquidweb
+ |
+ v3.1.0 | +
| + Loopia + | +Website | +
+ loopia
+ |
+ v4.2.0 | +
| + LuaDNS + | +Website | +
+ luadns
+ |
+ v3.7.0 | +
| + Manual + | ++ |
+ manual
+ |
+ v0.3.0 | +
| + MyDNS.jp + | +Website | +
+ mydnsjp
+ |
+ v1.2.0 | +
| + MythicBeasts + | +Website | +
+ mythicbeasts
+ |
+ v0.3.7 | +
| + Name.com + | +Website | +
+ namedotcom
+ |
+ v0.5.0 | +
| + Namecheap + | +Website | +
+ namecheap
+ |
+ v0.3.0 | +
| + Namesilo + | +Website | +
+ namesilo
+ |
+ v2.7.0 | +
| + NearlyFreeSpeech.NET + | +Website | +
+ nearlyfreespeech
+ |
+ v4.8.0 | +
| + Netcup + | +Website | +
+ netcup
+ |
+ v1.1.0 | +
| + Netlify + | +Website | +
+ netlify
+ |
+ v3.7.0 | +
| + Nicmanager + | +Website | +
+ nicmanager
+ |
+ v4.5.0 | +
| + NIFCloud + | +Website | +
+ nifcloud
+ |
+ v1.1.0 | +
| + Njalla + | +Website | +
+ njalla
+ |
+ v4.3.0 | +
| + Nodion + | +Website | +
+ nodion
+ |
+ v4.11.0 | +
| + NS1 + | +Website | +
+ ns1
+ |
+ v0.4.0 | +
| + Open Telekom Cloud + | +Website | +
+ otc
+ |
+ v0.4.1 | +
| + Oracle Cloud + | +Website | +
+ oraclecloud
+ |
+ v2.3.0 | +
| + OVH + | +Website | +
+ ovh
+ |
+ v0.4.0 | +
| + plesk.com + | +Website | +
+ plesk
+ |
+ v4.11.0 | +
| + Porkbun + | +Website | +
+ porkbun
+ |
+ v4.4.0 | +
| + PowerDNS + | +Website | +
+ pdns
+ |
+ v0.4.0 | +
| + Rackspace + | +Website | +
+ rackspace
+ |
+ v0.4.0 | +
| + RcodeZero + | +Website | +
+ rcodezero
+ |
+ v4.13 | +
| + reg.ru + | +Website | +
+ regru
+ |
+ v3.5.0 | +
| + RFC2136 + | +Website | +
+ rfc2136
+ |
+ v0.3.0 | +
| + RimuHosting + | +Website | +
+ rimuhosting
+ |
+ v0.3.5 | +
| + Sakura Cloud + | +Website | +
+ sakuracloud
+ |
+ v1.1.0 | +
| + Scaleway + | +Website | +
+ scaleway
+ |
+ v3.4.0 | +
| + Selectel + | +Website | +
+ selectel
+ |
+ v1.2.0 | +
| + Servercow + | +Website | +
+ servercow
+ |
+ v3.4.0 | +
| + Simply.com + | +Website | +
+ simply
+ |
+ v4.4.0 | +
| + Sonic + | +Website | +
+ sonic
+ |
+ v4.4.0 | +
| + Stackpath + | +Website | +
+ stackpath
+ |
+ v1.1.0 | +
| + Tencent Cloud DNS + | +Website | +
+ tencentcloud
+ |
+ v4.6.0 | +
| + TransIP + | +Website | +
+ transip
+ |
+ v2.0.0 | +
| + UKFast SafeDNS + | +Website | +
+ safedns
+ |
+ v4.6.0 | +
| + Ultradns + | +Website | +
+ ultradns
+ |
+ v4.10.0 | +
| + Variomedia + | +Website | +
+ variomedia
+ |
+ v4.8.0 | +
| + VegaDNS + | +Website | +
+ vegadns
+ |
+ v1.1.0 | +
| + Vercel + | +Website | +
+ vercel
+ |
+ v4.7.0 | +
| + Versio.[nl|eu|uk] + | +Website | +
+ versio
+ |
+ v2.7.0 | +
| + VinylDNS + | +Website | +
+ vinyldns
+ |
+ v4.4.0 | +
| + VK Cloud + | +Website | +
+ vkcloud
+ |
+ v4.9.0 | +
| + Vscale + | +Website | +
+ vscale
+ |
+ v2.0.0 | +
| + Vultr + | +Website | +
+ vultr
+ |
+ v0.3.1 | +
| + Websupport + | +Website | +
+ websupport
+ |
+ v4.10.0 | +
| + WEDOS + | +Website | +
+ wedos
+ |
+ v4.4.0 | +
| + Yandex Cloud + | +Website | +
+ yandexcloud
+ |
+ v4.9.0 | +
| + Yandex PDD + | +Website | +
+ yandex
+ |
+ v3.7.0 | +
| + Zone.ee + | +Website | +
+ zoneee
+ |
+ v2.1.0 | +
| + Zonomi + | +Website | +
+ zonomi
+ |
+ v3.5.0 | +
Configuration for Infoblox.
+infobloxHere is an example bash command using the Infoblox provider:
+INFOBLOX_USERNAME=api-user-529 \
+INFOBLOX_PASSWORD=b9841238feb177a84330febba8a83208921177bffe733 \
+INFOBLOX_HOST=infoblox.example.org
+lego --email you@example.com --dns infoblox --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
INFOBLOX_HOST |
+Host URI | +
INFOBLOX_PASSWORD |
+Account Password | +
INFOBLOX_USERNAME |
+Account Username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
INFOBLOX_DNS_VIEW |
+The view for the TXT records, default: External | +
INFOBLOX_HTTP_TIMEOUT |
+HTTP request timeout | +
INFOBLOX_POLLING_INTERVAL |
+Time between DNS propagation check | +
INFOBLOX_PORT |
+The port for the infoblox grid manager, default: 443 | +
INFOBLOX_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
INFOBLOX_SSL_VERIFY |
+Whether or not to verify the TLS certificate, default: true | +
INFOBLOX_TTL |
+The TTL of the TXT record used for the DNS challenge | +
INFOBLOX_WAPI_VERSION |
+The version of WAPI being used, default: 2.11 | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
When creating an API’s user ensure it has the proper permissions for the view you are working with.
+Configuration for Infomaniak.
+infomaniakHere is an example bash command using the Infomaniak provider:
+INFOMANIAK_ACCESS_TOKEN=1234567898765432 \
+lego --email you@example.com --dns infomaniak --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
INFOMANIAK_ACCESS_TOKEN |
+Access token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
INFOMANIAK_ENDPOINT |
+https://api.infomaniak.com | +
INFOMANIAK_HTTP_TIMEOUT |
+API request timeout | +
INFOMANIAK_POLLING_INTERVAL |
+Time between DNS propagation check | +
INFOMANIAK_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
INFOMANIAK_TTL |
+The TTL of the TXT record used for the DNS challenge in seconds | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Access token can be created at the url https://manager.infomaniak.com/v3/infomaniak-api. +You will need domain scope.
+Configuration for Internet.bs.
+internetbsHere is an example bash command using the Internet.bs provider:
+INTERNET_BS_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxx \
+INTERNET_BS_PASSWORD=yyyyyyyyyyyyyyyyyyyyyyyyyy \
+lego --email you@example.com --dns internetbs --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
INTERNET_BS_API_KEY |
+API key | +
INTERNET_BS_PASSWORD |
+API password | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
INTERNET_BS_HTTP_TIMEOUT |
+API request timeout | +
INTERNET_BS_POLLING_INTERVAL |
+Time between DNS propagation check | +
INTERNET_BS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
INTERNET_BS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for INWX.
+inwxHere is an example bash command using the INWX provider:
+INWX_USERNAME=xxxxxxxxxx \
+INWX_PASSWORD=yyyyyyyyyy \
+lego --email you@example.com --dns inwx --domains my.example.org run
+
+# 2FA
+INWX_USERNAME=xxxxxxxxxx \
+INWX_PASSWORD=yyyyyyyyyy \
+INWX_SHARED_SECRET=zzzzzzzzzz \
+lego --email you@example.com --dns inwx --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
INWX_PASSWORD |
+Password | +
INWX_USERNAME |
+Username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
INWX_POLLING_INTERVAL |
+Time between DNS propagation check | +
INWX_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation (default 360s) | +
INWX_SANDBOX |
+Activate the sandbox (boolean) | +
INWX_SHARED_SECRET |
+shared secret related to 2FA | +
INWX_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Ionos.
+ionosHere is an example bash command using the Ionos provider:
+IONOS_API_KEY=xxxxxxxx \
+lego --email you@example.com --dns ionos --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
IONOS_API_KEY |
+API key <prefix>.<secret> https://developer.hosting.ionos.com/docs/getstarted |
+
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
IONOS_HTTP_TIMEOUT |
+API request timeout | +
IONOS_POLLING_INTERVAL |
+Time between DNS propagation check | +
IONOS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
IONOS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for iwantmyname.
+iwantmynameHere is an example bash command using the iwantmyname provider:
+IWANTMYNAME_USERNAME=xxxxxxxx \
+IWANTMYNAME_PASSWORD=xxxxxxxx \
+lego --email you@example.com --dns iwantmyname --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
IWANTMYNAME_PASSWORD |
+API password | +
IWANTMYNAME_USERNAME |
+API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
IWANTMYNAME_HTTP_TIMEOUT |
+API request timeout | +
IWANTMYNAME_POLLING_INTERVAL |
+Time between DNS propagation check | +
IWANTMYNAME_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
IWANTMYNAME_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Joker.
+jokerHere is an example bash command using the Joker provider:
+# SVC
+JOKER_API_MODE=SVC \
+JOKER_USERNAME=<your email> \
+JOKER_PASSWORD=<your password> \
+lego --email you@example.com --dns joker --domains my.example.org run
+
+# DMAPI
+JOKER_API_MODE=DMAPI \
+JOKER_USERNAME=<your email> \
+JOKER_PASSWORD=<your password> \
+lego --email you@example.com --dns joker --domains my.example.org run
+## or
+JOKER_API_MODE=DMAPI \
+JOKER_API_KEY=<your API key> \
+lego --email you@example.com --dns joker --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
JOKER_API_KEY |
+API key (only with DMAPI mode) | +
JOKER_API_MODE |
+‘DMAPI’ or ‘SVC’. DMAPI is for resellers accounts. (Default: DMAPI) | +
JOKER_PASSWORD |
+Joker.com password | +
JOKER_USERNAME |
+Joker.com username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
JOKER_HTTP_TIMEOUT |
+API request timeout | +
JOKER_POLLING_INTERVAL |
+Time between DNS propagation check | +
JOKER_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
JOKER_SEQUENCE_INTERVAL |
+Time between sequential requests (only with ‘SVC’ mode) | +
JOKER_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
In the SVC mode, username and passsword are not your email and account passwords, but those displayed in Joker.com domain dashboard when enabling Dynamic DNS.
+As per Joker.com documentation:
++++
+- +
+please login at Joker.com, visit ‘My Domains’, +find the domain you want to add Let’s Encrypt certificate for, and chose “DNS” in the menu
+- +
+on the top right, you will find the setting for ‘Dynamic DNS’. +If not already active, please activate it. +It will not affect any other already existing DNS records of this domain.
+- +
+please take a note of the credentials which are now shown as ‘Dynamic DNS Authentication’, consisting of a ‘username’ and a ‘password’.
+- +
+this is all you have to do here - and only once per domain.
+
Configuration for Liara.
+liaraHere is an example bash command using the Liara provider:
+LIARA_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
+lego --email myemail@example.com --dns liara --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
LIARA_API_KEY |
+The API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
LIARA_HTTP_TIMEOUT |
+API request timeout | +
LIARA_POLLING_INTERVAL |
+Time between DNS propagation check | +
LIARA_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
LIARA_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Amazon Lightsail.
+lightsailPlease contribute by adding a CLI example.
+| Environment Variable Name | +Description | +
|---|---|
AWS_ACCESS_KEY_ID |
+Managed by the AWS client. Access key ID (AWS_ACCESS_KEY_ID_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
+
AWS_SECRET_ACCESS_KEY |
+Managed by the AWS client. Secret access key (AWS_SECRET_ACCESS_KEY_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
+
DNS_ZONE |
+Domain name of the DNS zone | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AWS_SHARED_CREDENTIALS_FILE |
+Managed by the AWS client. Shared credentials file. | +
LIGHTSAIL_POLLING_INTERVAL |
+Time between DNS propagation check | +
LIGHTSAIL_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
AWS Credentials are automatically detected in the following locations and prioritized in the following order:
+AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, [AWS_SESSION_TOKEN]~/.aws/credentials, profiles can be specified using AWS_PROFILE)AWS region is not required to set as the Lightsail DNS zone is in global (us-east-1) region.
+The following AWS IAM policy document describes the minimum permissions required for lego to complete the DNS challenge.
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "lightsail:DeleteDomainEntry",
+ "lightsail:CreateDomainEntry"
+ ],
+ "Resource": "<Lightsail DNS zone ARN>"
+ }
+ ]
+}
+Replace the Resource value with your Lightsail DNS zone ARN.
+You can retrieve the ARN using aws cli by running aws lightsail get-domains --region us-east-1 (Lightsail web console does not show the ARN, unfortunately).
+It should be in the format of arn:aws:lightsail:global:<ACCOUNT ID>:Domain/<DOMAIN ID>.
+You also need to replace the region in the ARN to us-east-1 (instead of global).
Alternatively, you can also set the Resource to * (wildcard), which allow to access all domain, but this is not recommended.
Configuration for Linode (v4).
+linodeHere is an example bash command using the Linode (v4) provider:
+LINODE_TOKEN=xxxxx \
+lego --email you@example.com --dns linode --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
LINODE_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
LINODE_HTTP_TIMEOUT |
+API request timeout | +
LINODE_POLLING_INTERVAL |
+Time between DNS propagation check | +
LINODE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
LINODE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Liquid Web.
+liquidwebHere is an example bash command using the Liquid Web provider:
+LIQUID_WEB_USERNAME=someuser \
+LIQUID_WEB_PASSWORD=somepass \
+LIQUID_WEB_ZONE=tacoman.com.net \
+lego --email you@example.com --dns liquidweb --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
LIQUID_WEB_PASSWORD |
+Storm API Password | +
LIQUID_WEB_USERNAME |
+Storm API Username | +
LIQUID_WEB_ZONE |
+DNS Zone | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
LIQUID_WEB_HTTP_TIMEOUT |
+Maximum waiting time for the DNS records to be created (not verified) | +
LIQUID_WEB_POLLING_INTERVAL |
+Time between DNS propagation check | +
LIQUID_WEB_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
LIQUID_WEB_TTL |
+The TTL of the TXT record used for the DNS challenge | +
LIQUID_WEB_URL |
+Storm API endpoint | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Loopia.
+loopiaHere is an example bash command using the Loopia provider:
+LOOPIA_API_USER=xxxxxxxx \
+LOOPIA_API_PASSWORD=yyyyyyyy \
+lego --email my@email.com --dns loopia --domains my.domain.com run
+| Environment Variable Name | +Description | +
|---|---|
LOOPIA_API_PASSWORD |
+API password | +
LOOPIA_API_USER |
+API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
LOOPIA_API_URL |
+API endpoint. Ex: https://api.loopia.se/RPCSERV or https://api.loopia.rs/RPCSERV | +
LOOPIA_HTTP_TIMEOUT |
+API request timeout | +
LOOPIA_POLLING_INTERVAL |
+Time between DNS propagation check | +
LOOPIA_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
LOOPIA_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
You can generate a new API user from your account page.
+It needs to have the following permissions:
+Configuration for LuaDNS.
+luadnsHere is an example bash command using the LuaDNS provider:
+LUADNS_API_USERNAME=youremail \
+LUADNS_API_TOKEN=xxxxxxxx \
+lego --email you@example.com --dns luadns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
LUADNS_API_TOKEN |
+API token | +
LUADNS_API_USERNAME |
+Username (your email) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
LUADNS_HTTP_TIMEOUT |
+API request timeout | +
LUADNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
LUADNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
LUADNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Solving the DNS-01 challenge using CLI prompt.
+To start using the CLI prompt “provider”, start lego with --dns manual:
$ lego --email "you@example.com" --domains="example.com" --dns "manual" run
+What follows are a few log print outs, interspersed with some prompts, asking for you to do perform some actions:
+No key found for account you@example.com. Generating a P256 key.
+Saved key to ./.lego/accounts/acme-v02.api.letsencrypt.org/you@example.com/keys/you@example.com.key
+Please review the TOS at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
+Do you accept the TOS? Y/n
+If you accept the linked Terms of Service, hit Enter.
[INFO] acme: Registering account for you@example.com
+!!!! HEADS UP !!!!
+
+ Your account credentials have been saved in your Let's Encrypt
+ configuration directory at "./.lego/accounts".
+
+ You should make a secure backup of this folder now. This
+ configuration directory will also contain certificates and
+ private keys obtained from Let's Encrypt so making regular
+ backups of this folder is ideal.
+[INFO] [example.com] acme: Obtaining bundled SAN certificate
+[INFO] [example.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/2345678901
+[INFO] [example.com] acme: Could not find solver for: tls-alpn-01
+[INFO] [example.com] acme: Could not find solver for: http-01
+[INFO] [example.com] acme: use dns-01 solver
+[INFO] [example.com] acme: Preparing to solve DNS-01
+lego: Please create the following TXT record in your example.com. zone:
+_acme-challenge.example.com. 120 IN TXT "hX0dPkG6Gfs9hUvBAchQclkyyoEKbShbpvJ9mY5q2JQ"
+lego: Press 'Enter' when you are done
+Do as instructed, and create the TXT records, and hit Enter.
[INFO] [example.com] acme: Trying to solve DNS-01
+[INFO] [example.com] acme: Checking DNS record propagation using [192.168.8.1:53]
+[INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
+[INFO] [example.com] acme: Waiting for DNS record propagation.
+[INFO] [example.com] The server validated our request
+[INFO] [example.com] acme: Cleaning DNS-01 challenge
+lego: You can now remove this TXT record from your example.com. zone:
+_acme-challenge.example.com. 120 IN TXT "hX0dPkG6Gfs9hUvBAchQclkyyoEKbShbpvJ9mY5q2JQ"
+[INFO] [example.com] acme: Validations succeeded; requesting certificates
+[INFO] [example.com] Server responded with a certificate.
+As mentioned, you can now remove the TXT record again.
+ + + + +Configuration for MyDNS.jp.
+mydnsjpHere is an example bash command using the MyDNS.jp provider:
+MYDNSJP_MASTER_ID=xxxxx \
+MYDNSJP_PASSWORD=xxxxx \
+lego --email you@example.com --dns mydnsjp --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
MYDNSJP_MASTER_ID |
+Master ID | +
MYDNSJP_PASSWORD |
+Password | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
MYDNSJP_HTTP_TIMEOUT |
+API request timeout | +
MYDNSJP_POLLING_INTERVAL |
+Time between DNS propagation check | +
MYDNSJP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
MYDNSJP_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for MythicBeasts.
+mythicbeastsHere is an example bash command using the MythicBeasts provider:
+MYTHICBEASTS_USERNAME=myuser \
+MYTHICBEASTS_PASSWORD=mypass \
+lego --email you@example.com --dns mythicbeasts --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
MYTHICBEASTS_PASSWORD |
+Password | +
MYTHICBEASTS_USERNAME |
+User name | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
MYTHICBEASTS_API_ENDPOINT |
+The endpoint for the API (must implement v2) | +
MYTHICBEASTS_AUTH_API_ENDPOINT |
+The endpoint for Mythic Beasts’ Authentication | +
MYTHICBEASTS_HTTP_TIMEOUT |
+API request timeout | +
MYTHICBEASTS_POLLING_INTERVAL |
+Time between DNS propagation check | +
MYTHICBEASTS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
MYTHICBEASTS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
If you are using specific API keys, then the username is the API ID for your API key, and the password is the API secret.
+Your API key name is not needed to operate lego.
+Configuration for Namecheap.
+To enable API access on the Namecheap production environment, some opaque requirements must be met. +More information in the section Enabling API Access of the Namecheap documentation. +(2020-08: Account balance of $50+, 20+ domains in your account, or purchases totaling $50+ within the last 2 years.)
+namecheapHere is an example bash command using the Namecheap provider:
+NAMECHEAP_API_USER=user \
+NAMECHEAP_API_KEY=key \
+lego --email you@example.com --dns namecheap --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NAMECHEAP_API_KEY |
+API key | +
NAMECHEAP_API_USER |
+API user | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NAMECHEAP_HTTP_TIMEOUT |
+API request timeout | +
NAMECHEAP_POLLING_INTERVAL |
+Time between DNS propagation check | +
NAMECHEAP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NAMECHEAP_SANDBOX |
+Activate the sandbox (boolean) | +
NAMECHEAP_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Name.com.
+namedotcomHere is an example bash command using the Name.com provider:
+NAMECOM_USERNAME=foo.bar \
+NAMECOM_API_TOKEN=a379a6f6eeafb9a55e378c118034e2751e682fab \
+lego --email you@example.com --dns namedotcom --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NAMECOM_API_TOKEN |
+API token | +
NAMECOM_USERNAME |
+Username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NAMECOM_HTTP_TIMEOUT |
+API request timeout | +
NAMECOM_POLLING_INTERVAL |
+Time between DNS propagation check | +
NAMECOM_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NAMECOM_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Namesilo.
+namesiloHere is an example bash command using the Namesilo provider:
+NAMESILO_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
+lego --email you@example.com --dns namesilo --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NAMESILO_API_KEY |
+Client ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NAMESILO_POLLING_INTERVAL |
+Time between DNS propagation check | +
NAMESILO_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation, it is better to set larger than 15m | +
NAMESILO_TTL |
+The TTL of the TXT record used for the DNS challenge, should be in [3600, 2592000] | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for NearlyFreeSpeech.NET.
+nearlyfreespeechHere is an example bash command using the NearlyFreeSpeech.NET provider:
+NEARLYFREESPEECH_API_KEY=xxxxxx \
+NEARLYFREESPEECH_LOGIN=xxxx \
+lego --email you@example.com --dns nearlyfreespeech --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NEARLYFREESPEECH_API_KEY |
+API Key for API requests | +
NEARLYFREESPEECH_LOGIN |
+Username for API requests | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NEARLYFREESPEECH_HTTP_TIMEOUT |
+API request timeout | +
NEARLYFREESPEECH_POLLING_INTERVAL |
+Time between DNS propagation check | +
NEARLYFREESPEECH_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NEARLYFREESPEECH_SEQUENCE_INTERVAL |
+Time between sequential requests | +
NEARLYFREESPEECH_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Netcup.
+netcupHere is an example bash command using the Netcup provider:
+NETCUP_CUSTOMER_NUMBER=xxxx \
+NETCUP_API_KEY=yyyy \
+NETCUP_API_PASSWORD=zzzz \
+lego --email you@example.com --dns netcup --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NETCUP_API_KEY |
+API key | +
NETCUP_API_PASSWORD |
+API password | +
NETCUP_CUSTOMER_NUMBER |
+Customer number | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NETCUP_HTTP_TIMEOUT |
+API request timeout | +
NETCUP_POLLING_INTERVAL |
+Time between DNS propagation check | +
NETCUP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NETCUP_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Netlify.
+netlifyHere is an example bash command using the Netlify provider:
+NETLIFY_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns netlify --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NETLIFY_TOKEN |
+Token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NETLIFY_HTTP_TIMEOUT |
+API request timeout | +
NETLIFY_POLLING_INTERVAL |
+Time between DNS propagation check | +
NETLIFY_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NETLIFY_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Nicmanager.
+nicmanagerHere is an example bash command using the Nicmanager provider:
+## Login using email
+
+NICMANAGER_API_EMAIL = "you@example.com" \
+NICMANAGER_API_PASSWORD = "password" \
+
+# Optionally, if your account has TOTP enabled, set the secret here
+NICMANAGER_API_OTP = "long-secret" \
+
+lego --email you@example.com --dns nicmanager --domains my.example.org run
+
+## Login using account name + username
+
+NICMANAGER_API_LOGIN = "myaccount" \
+NICMANAGER_API_USERNAME = "myuser" \
+NICMANAGER_API_PASSWORD = "password" \
+
+# Optionally, if your account has TOTP enabled, set the secret here
+NICMANAGER_API_OTP = "long-secret" \
+
+lego --email you@example.com --dns nicmanager --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NICMANAGER_API_EMAIL |
+Email-based login | +
NICMANAGER_API_LOGIN |
+Login, used for Username-based login | +
NICMANAGER_API_PASSWORD |
+Password, always required | +
NICMANAGER_API_USERNAME |
+Username, used for Username-based login | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NICMANAGER_API_MODE |
+mode: ‘anycast’ or ‘zone’ (default: ‘anycast’) | +
NICMANAGER_API_OTP |
+TOTP Secret (optional) | +
NICMANAGER_HTTP_TIMEOUT |
+API request timeout | +
NICMANAGER_POLLING_INTERVAL |
+Time between DNS propagation check | +
NICMANAGER_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NICMANAGER_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
You can login using your account name + username or using your email address.
+Optionally if TOTP is configured for your account, set NICMANAGER_API_OTP.
Configuration for NIFCloud.
+nifcloudHere is an example bash command using the NIFCloud provider:
+NIFCLOUD_ACCESS_KEY_ID=xxxx \
+NIFCLOUD_SECRET_ACCESS_KEY=yyyy \
+lego --email you@example.com --dns nifcloud --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NIFCLOUD_ACCESS_KEY_ID |
+Access key | +
NIFCLOUD_SECRET_ACCESS_KEY |
+Secret access key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NIFCLOUD_HTTP_TIMEOUT |
+API request timeout | +
NIFCLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
NIFCLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NIFCLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Njalla.
+njallaHere is an example bash command using the Njalla provider:
+NJALLA_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns njalla --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NJALLA_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NJALLA_HTTP_TIMEOUT |
+API request timeout | +
NJALLA_POLLING_INTERVAL |
+Time between DNS propagation check | +
NJALLA_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NJALLA_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Nodion.
+nodionHere is an example bash command using the Nodion provider:
+NODION_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
+lego --email myemail@example.com --dns nodion --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NODION_API_TOKEN |
+The API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NODION_HTTP_TIMEOUT |
+API request timeout | +
NODION_POLLING_INTERVAL |
+Time between DNS propagation check | +
NODION_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NODION_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for NS1.
+ns1Here is an example bash command using the NS1 provider:
+NS1_API_KEY=xxxx \
+lego --email you@example.com --dns ns1 --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
NS1_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
NS1_HTTP_TIMEOUT |
+API request timeout | +
NS1_POLLING_INTERVAL |
+Time between DNS propagation check | +
NS1_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
NS1_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Oracle Cloud.
+oraclecloudHere is an example bash command using the Oracle Cloud provider:
+OCI_PRIVKEY_FILE="~/.oci/oci_api_key.pem" \
+OCI_PRIVKEY_PASS="secret" \
+OCI_TENANCY_OCID="ocid1.tenancy.oc1..secret" \
+OCI_USER_OCID="ocid1.user.oc1..secret" \
+OCI_PUBKEY_FINGERPRINT="00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00" \
+OCI_REGION="us-phoenix-1" \
+OCI_COMPARTMENT_OCID="ocid1.tenancy.oc1..secret" \
+lego --email you@example.com --dns oraclecloud --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
OCI_COMPARTMENT_OCID |
+Compartment OCID | +
OCI_PRIVKEY_FILE |
+Private key file | +
OCI_PRIVKEY_PASS |
+Private key password | +
OCI_PUBKEY_FINGERPRINT |
+Public key fingerprint | +
OCI_REGION |
+Region | +
OCI_TENANCY_OCID |
+Tenancy OCID | +
OCI_USER_OCID |
+User OCID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
OCI_POLLING_INTERVAL |
+Time between DNS propagation check | +
OCI_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
OCI_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Open Telekom Cloud.
+otcPlease contribute by adding a CLI example.
+| Environment Variable Name | +Description | +
|---|---|
OTC_DOMAIN_NAME |
+Domain name | +
OTC_IDENTITY_ENDPOINT |
+Identity endpoint URL | +
OTC_PASSWORD |
+Password | +
OTC_PROJECT_NAME |
+Project name | +
OTC_USER_NAME |
+User name | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
OTC_HTTP_TIMEOUT |
+API request timeout | +
OTC_POLLING_INTERVAL |
+Time between DNS propagation check | +
OTC_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
OTC_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for OVH.
+ovhHere is an example bash command using the OVH provider:
+OVH_APPLICATION_KEY=1234567898765432 \
+OVH_APPLICATION_SECRET=b9841238feb177a84330febba8a832089 \
+OVH_CONSUMER_KEY=256vfsd347245sdfg \
+OVH_ENDPOINT=ovh-eu \
+lego --email you@example.com --dns ovh --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
OVH_APPLICATION_KEY |
+Application key | +
OVH_APPLICATION_SECRET |
+Application secret | +
OVH_CONSUMER_KEY |
+Consumer key | +
OVH_ENDPOINT |
+Endpoint URL (ovh-eu or ovh-ca) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
OVH_HTTP_TIMEOUT |
+API request timeout | +
OVH_POLLING_INTERVAL |
+Time between DNS propagation check | +
OVH_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
OVH_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Application key and secret can be created by following the OVH guide.
+When requesting the consumer key, the following configuration can be use to define access rights:
+{
+ "accessRules": [
+ {
+ "method": "POST",
+ "path": "/domain/zone/*"
+ },
+ {
+ "method": "DELETE",
+ "path": "/domain/zone/*"
+ }
+ ]
+}
+Configuration for PowerDNS.
+pdnsHere is an example bash command using the PowerDNS provider:
+PDNS_API_URL=http://pdns-server:80/ \
+PDNS_API_KEY=xxxx \
+lego --email you@example.com --dns pdns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
PDNS_API_KEY |
+API key | +
PDNS_API_URL |
+API URL | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
PDNS_HTTP_TIMEOUT |
+API request timeout | +
PDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
PDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
PDNS_SERVER_NAME |
+Name of the server in the URL, ’localhost’ by default | +
PDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Tested and confirmed to work with PowerDNS authoritative server 3.4.8 and 4.0.1. Refer to PowerDNS documentation instructions on how to enable the built-in API interface.
+PowerDNS Notes:
+_acme-challenge record is added/modified via the API, set SOA-EDIT-API to INCEPTION-INCREMENT for the zone in the domainmetadata tableConfiguration for plesk.com.
+pleskHere is an example bash command using the plesk.com provider:
+PLESK_SERVER_BASE_URL="https://plesk.myserver.com:8443" \
+PLESK_USERNAME=xxxxxx \
+PLESK_PASSWORD=yyyyyy \
+lego --email you@example.com --dns plesk --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
PLESK_PASSWORD |
+API password | +
PLESK_SERVER_BASE_URL |
+Base URL of the server (ex: https://plesk.myserver.com:8443) | +
PLESK_USERNAME |
+API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
PLESK_HTTP_TIMEOUT |
+API request timeout | +
PLESK_POLLING_INTERVAL |
+Time between DNS propagation check | +
PLESK_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
PLESK_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Porkbun.
+porkbunHere is an example bash command using the Porkbun provider:
+PORKBUN_SECRET_API_KEY=xxxxxx \
+PORKBUN_API_KEY=yyyyyy \
+lego --email you@example.com --dns porkbun --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
PORKBUN_API_KEY |
+API key | +
PORKBUN_SECRET_API_KEY |
+secret API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
PORKBUN_HTTP_TIMEOUT |
+API request timeout | +
PORKBUN_POLLING_INTERVAL |
+Time between DNS propagation check | +
PORKBUN_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
PORKBUN_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Rackspace.
+rackspaceHere is an example bash command using the Rackspace provider:
+RACKSPACE_USER=xxxx \
+RACKSPACE_API_KEY=yyyy \
+lego --email you@example.com --dns rackspace --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
RACKSPACE_API_KEY |
+API key | +
RACKSPACE_USER |
+API user | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
RACKSPACE_HTTP_TIMEOUT |
+API request timeout | +
RACKSPACE_POLLING_INTERVAL |
+Time between DNS propagation check | +
RACKSPACE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
RACKSPACE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for RcodeZero.
+rcodezeroHere is an example bash command using the RcodeZero provider:
+RCODEZERO_API_TOKEN=<mytoken> \
+lego --email you@example.com --dns rcodezero --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
RCODEZERO_API_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
RCODEZERO_HTTP_TIMEOUT |
+API request timeout | +
RCODEZERO_POLLING_INTERVAL |
+Time between DNS propagation check | +
RCODEZERO_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
RCODEZERO_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Generate your API Token via https://my.rcodezero.at with the ACME permissions.
+This are special tokens with limited access for ACME requests only.
RcodeZero is an Anycast Network so the distribution of the DNS01-Challenge can take up to 2 minutes.
+Configuration for reg.ru.
+regruHere is an example bash command using the reg.ru provider:
+REGRU_USERNAME=xxxxxx \
+REGRU_PASSWORD=yyyyyy \
+lego --email you@example.com --dns regru --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
REGRU_PASSWORD |
+API password | +
REGRU_USERNAME |
+API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
REGRU_HTTP_TIMEOUT |
+API request timeout | +
REGRU_POLLING_INTERVAL |
+Time between DNS propagation check | +
REGRU_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
REGRU_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for RFC2136.
+rfc2136Here is an example bash command using the RFC2136 provider:
+RFC2136_NAMESERVER=127.0.0.1 \
+RFC2136_TSIG_KEY=lego \
+RFC2136_TSIG_ALGORITHM=hmac-sha256. \
+RFC2136_TSIG_SECRET=YWJjZGVmZGdoaWprbG1ub3BxcnN0dXZ3eHl6MTIzNDU= \
+lego --email you@example.com --dns rfc2136 --domains my.example.org run
+
+## ---
+
+keyname=lego; keyfile=lego.key; tsig-keygen $keyname > $keyfile
+
+RFC2136_NAMESERVER=127.0.0.1 \
+RFC2136_TSIG_KEY="$keyname" \
+RFC2136_TSIG_ALGORITHM="$( awk -F'[ ";]' '/algorithm/ { print $2 }' $keyfile )." \
+RFC2136_TSIG_SECRET="$( awk -F'[ ";]' '/secret/ { print $3 }' $keyfile )" \
+lego --email you@example.com --dns rfc2136 --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
RFC2136_NAMESERVER |
+Network address in the form “host” or “host:port” | +
RFC2136_TSIG_ALGORITHM |
+TSIG algorithm. See miekg/dns#tsig.go for supported values. To disable TSIG authentication, leave the RFC2136_TSIG* variables unset. |
+
RFC2136_TSIG_KEY |
+Name of the secret key as defined in DNS server configuration. To disable TSIG authentication, leave the RFC2136_TSIG* variables unset. |
+
RFC2136_TSIG_SECRET |
+Secret key payload. To disable TSIG authentication, leave the RFC2136_TSIG* variables unset. |
+
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
RFC2136_DNS_TIMEOUT |
+API request timeout | +
RFC2136_POLLING_INTERVAL |
+Time between DNS propagation check | +
RFC2136_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
RFC2136_SEQUENCE_INTERVAL |
+Time between sequential requests | +
RFC2136_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for RimuHosting.
+rimuhostingHere is an example bash command using the RimuHosting provider:
+RIMUHOSTING_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns rimuhosting --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
RIMUHOSTING_API_KEY |
+User API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
RIMUHOSTING_HTTP_TIMEOUT |
+API request timeout | +
RIMUHOSTING_POLLING_INTERVAL |
+Time between DNS propagation check | +
RIMUHOSTING_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
RIMUHOSTING_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Amazon Route 53.
+route53Here is an example bash command using the Amazon Route 53 provider:
+AWS_ACCESS_KEY_ID=your_key_id \
+AWS_SECRET_ACCESS_KEY=your_secret_access_key \
+AWS_REGION=aws-region \
+AWS_HOSTED_ZONE_ID=your_hosted_zone_id \
+ --domains example.com --email your_example@email.com --dns route53 --accept-tos=true run
+| Environment Variable Name | +Description | +
|---|---|
AWS_ACCESS_KEY_ID |
+Managed by the AWS client. Access key ID (AWS_ACCESS_KEY_ID_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
+
AWS_ASSUME_ROLE_ARN |
+Managed by the AWS Role ARN (AWS_ASSUME_ROLE_ARN_FILE is not supported) |
+
AWS_EXTERNAL_ID |
+Managed by STS AssumeRole API operation (AWS_EXTERNAL_ID_FILE is not supported) |
+
AWS_HOSTED_ZONE_ID |
+Override the hosted zone ID. | +
AWS_PROFILE |
+Managed by the AWS client (AWS_PROFILE_FILE is not supported) |
+
AWS_REGION |
+Managed by the AWS client (AWS_REGION_FILE is not supported) |
+
AWS_SDK_LOAD_CONFIG |
+Managed by the AWS client. Retrieve the region from the CLI config file (AWS_SDK_LOAD_CONFIG_FILE is not supported) |
+
AWS_SECRET_ACCESS_KEY |
+Managed by the AWS client. Secret access key (AWS_SECRET_ACCESS_KEY_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
+
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
AWS_MAX_RETRIES |
+The number of maximum returns the service will use to make an individual API request | +
AWS_POLLING_INTERVAL |
+Time between DNS propagation check | +
AWS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
AWS_SHARED_CREDENTIALS_FILE |
+Managed by the AWS client. Shared credentials file. | +
AWS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
AWS Credentials are automatically detected in the following locations and prioritized in the following order:
+AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, [AWS_SESSION_TOKEN]~/.aws/credentials, profiles can be specified using AWS_PROFILE)The AWS Region is automatically detected in the following locations and prioritized in the following order:
+AWS_REGIONAWS_SDK_LOAD_CONFIG is set (defaults to ~/.aws/config, profiles can be specified using AWS_PROFILE)If AWS_HOSTED_ZONE_ID is not set, Lego tries to determine the correct public hosted zone via the FQDN.
See also:
+ +The following IAM policy document grants access to the required APIs needed by lego to complete the DNS challenge. +A word of caution: +These permissions grant write access to any DNS record in any hosted zone, +so it is recommended to narrow them down as much as possible if you are using this policy in production.
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "route53:GetChange",
+ "route53:ChangeResourceRecordSets",
+ "route53:ListResourceRecordSets"
+ ],
+ "Resource": [
+ "arn:aws:route53:::hostedzone/*",
+ "arn:aws:route53:::change/*"
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": "route53:ListHostedZonesByName",
+ "Resource": "*"
+ }
+ ]
+}
+The following AWS IAM policy document describes least privilege permissions required for lego to complete the DNS challenge.
+Write access is limited to a specified hosted zone’s DNS TXT records with a key of _acme-challenge.example.com.
+Replace Z11111112222222333333 with your hosted zone ID and example.com with your domain name to use this policy.
{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": "route53:GetChange",
+ "Resource": "arn:aws:route53:::change/*"
+ },
+ {
+ "Effect": "Allow",
+ "Action": "route53:ListHostedZonesByName",
+ "Resource": "*"
+ },
+ {
+ "Effect": "Allow",
+ "Action": [
+ "route53:ListResourceRecordSets"
+ ],
+ "Resource": [
+ "arn:aws:route53:::hostedzone/Z11111112222222333333"
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": [
+ "route53:ChangeResourceRecordSets"
+ ],
+ "Resource": [
+ "arn:aws:route53:::hostedzone/Z11111112222222333333"
+ ],
+ "Condition": {
+ "ForAllValues:StringEquals": {
+ "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+ "_acme-challenge.example.com"
+ ],
+ "route53:ChangeResourceRecordSetsRecordTypes": [
+ "TXT"
+ ]
+ }
+ }
+ }
+ ]
+}
+Configuration for UKFast SafeDNS.
+safednsHere is an example bash command using the UKFast SafeDNS provider:
+SAFEDNS_AUTH_TOKEN=xxxxxx \
+lego --email you@example.com --dns safedns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SAFEDNS_AUTH_TOKEN |
+Authentication token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SAFEDNS_HTTP_TIMEOUT |
+API request timeout | +
SAFEDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
SAFEDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SAFEDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Sakura Cloud.
+sakuracloudHere is an example bash command using the Sakura Cloud provider:
+SAKURACLOUD_ACCESS_TOKEN=xxxxx \
+SAKURACLOUD_ACCESS_TOKEN_SECRET=yyyyy \
+lego --email you@example.com --dns sakuracloud --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SAKURACLOUD_ACCESS_TOKEN |
+Access token | +
SAKURACLOUD_ACCESS_TOKEN_SECRET |
+Access token secret | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SAKURACLOUD_HTTP_TIMEOUT |
+API request timeout | +
SAKURACLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
SAKURACLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SAKURACLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Scaleway.
+scalewayHere is an example bash command using the Scaleway provider:
+SCALEWAY_API_TOKEN=xxxxxxx-xxxxx-xxxx-xxx-xxxxxx \
+lego --email you@example.com --dns scaleway --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SCALEWAY_API_TOKEN |
+API token | +
SCALEWAY_PROJECT_ID |
+Project to use (optional) | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SCALEWAY_POLLING_INTERVAL |
+Time between DNS propagation check | +
SCALEWAY_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SCALEWAY_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Selectel.
+selectelHere is an example bash command using the Selectel provider:
+SELECTEL_API_TOKEN=xxxxx \
+lego --email you@example.com --dns selectel --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SELECTEL_API_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SELECTEL_BASE_URL |
+API endpoint URL | +
SELECTEL_HTTP_TIMEOUT |
+API request timeout | +
SELECTEL_POLLING_INTERVAL |
+Time between DNS propagation check | +
SELECTEL_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SELECTEL_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Servercow.
+servercowHere is an example bash command using the Servercow provider:
+SERVERCOW_USERNAME=xxxxxxxx \
+SERVERCOW_PASSWORD=xxxxxxxx \
+lego --email you@example.com --dns servercow --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SERVERCOW_PASSWORD |
+API password | +
SERVERCOW_USERNAME |
+API username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SERVERCOW_HTTP_TIMEOUT |
+API request timeout | +
SERVERCOW_POLLING_INTERVAL |
+Time between DNS propagation check | +
SERVERCOW_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SERVERCOW_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Simply.com.
+simplyHere is an example bash command using the Simply.com provider:
+SIMPLY_ACCOUNT_NAME=xxxxxx \
+SIMPLY_API_KEY=yyyyyy \
+lego --email you@example.com --dns simply --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SIMPLY_ACCOUNT_NAME |
+Account name | +
SIMPLY_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SIMPLY_HTTP_TIMEOUT |
+API request timeout | +
SIMPLY_POLLING_INTERVAL |
+Time between DNS propagation check | +
SIMPLY_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SIMPLY_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Sonic.
+sonicHere is an example bash command using the Sonic provider:
+SONIC_USER_ID=12345 \
+SONIC_API_KEY=4d6fbf2f9ab0fa11697470918d37625851fc0c51 \
+lego --email you@example.com --dns sonic --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
SONIC_API_KEY |
+API Key | +
SONIC_USER_ID |
+User ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
SONIC_HTTP_TIMEOUT |
+API request timeout | +
SONIC_POLLING_INTERVAL |
+Time between DNS propagation check | +
SONIC_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
SONIC_SEQUENCE_INTERVAL |
+Time between sequential requests | +
SONIC_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
The API keys must be generated by calling the dyndns/api_key endpoint.
Example:
+$ curl -X POST -H "Content-Type: application/json" --data '{"username":"notarealuser","password":"notarealpassword","hostname":"example.com"}' https://public-api.sonic.net/dyndns/api_key
+{"userid":"12345","apikey":"4d6fbf2f9ab0fa11697470918d37625851fc0c51","result":200,"message":"OK"}
+See https://public-api.sonic.net/dyndns/#requesting_an_api_key for additional details.
+This userid and apikey combo allow modifications to any DNS entries connected to the managed domain (hostname).
Hostname should be the toplevel domain managed e.g example.com not www.example.com.
Configuration for Stackpath.
+stackpathHere is an example bash command using the Stackpath provider:
+STACKPATH_CLIENT_ID=xxxxx \
+STACKPATH_CLIENT_SECRET=yyyyy \
+STACKPATH_STACK_ID=zzzzz \
+lego --email you@example.com --dns stackpath --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
STACKPATH_CLIENT_ID |
+Client ID | +
STACKPATH_CLIENT_SECRET |
+Client secret | +
STACKPATH_STACK_ID |
+Stack ID | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
STACKPATH_POLLING_INTERVAL |
+Time between DNS propagation check | +
STACKPATH_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
STACKPATH_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Tencent Cloud DNS.
+tencentcloudHere is an example bash command using the Tencent Cloud DNS provider:
+TENCENTCLOUD_SECRET_ID=abcdefghijklmnopqrstuvwx \
+TENCENTCLOUD_SECRET_KEY=your-secret-key \
+lego --email you@example.com --dns tencentcloud --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
TENCENTCLOUD_SECRET_ID |
+Access key ID | +
TENCENTCLOUD_SECRET_KEY |
+Access Key secret | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
TENCENTCLOUD_HTTP_TIMEOUT |
+API request timeout | +
TENCENTCLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
TENCENTCLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
TENCENTCLOUD_REGION |
+Region | +
TENCENTCLOUD_SESSION_TOKEN |
+Access Key token | +
TENCENTCLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for TransIP.
+transipHere is an example bash command using the TransIP provider:
+TRANSIP_ACCOUNT_NAME = "Account name" \
+TRANSIP_PRIVATE_KEY_PATH = "transip.key" \
+lego --email you@example.com --dns transip --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
TRANSIP_ACCOUNT_NAME |
+Account name | +
TRANSIP_PRIVATE_KEY_PATH |
+Private key path | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
TRANSIP_POLLING_INTERVAL |
+Time between DNS propagation check | +
TRANSIP_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
TRANSIP_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Ultradns.
+ultradnsHere is an example bash command using the Ultradns provider:
+ULTRADNS_USERNAME=username \
+ULTRADNS_PASSWORD=password \
+lego --email you@example.com --dns ultradns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ULTRADNS_PASSWORD |
+API Password | +
ULTRADNS_USERNAME |
+API Username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
ULTRADNS_ENDPOINT |
+API endpoint URL, defaults to https://api.ultradns.com/ | +
ULTRADNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
ULTRADNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
ULTRADNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Variomedia.
+variomediaHere is an example bash command using the Variomedia provider:
+VARIOMEDIA_API_TOKEN=xxxx \
+lego --email you@example.com --dns variomedia --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
VARIOMEDIA_API_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
DODE_SEQUENCE_INTERVAL |
+Time between sequential requests | +
VARIOMEDIA_HTTP_TIMEOUT |
+API request timeout | +
VARIOMEDIA_POLLING_INTERVAL |
+Time between DNS propagation check | +
VARIOMEDIA_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VARIOMEDIA_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for VegaDNS.
+vegadnsPlease contribute by adding a CLI example.
+| Environment Variable Name | +Description | +
|---|---|
SECRET_VEGADNS_KEY |
+API key | +
SECRET_VEGADNS_SECRET |
+API secret | +
VEGADNS_URL |
+API endpoint URL | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VEGADNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
VEGADNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VEGADNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Vercel.
+vercelHere is an example bash command using the Vercel provider:
+VERCEL_API_TOKEN=xxxxxx \
+lego --email you@example.com --dns vercel --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
VERCEL_API_TOKEN |
+Authentication token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VERCEL_HTTP_TIMEOUT |
+API request timeout | +
VERCEL_POLLING_INTERVAL |
+Time between DNS propagation check | +
VERCEL_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VERCEL_TEAM_ID |
+Team ID (ex: team_xxxxxxxxxxxxxxxxxxxxxxxx) | +
VERCEL_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Versio.[nl|eu|uk].
+versioHere is an example bash command using the Versio.[nl|eu|uk] provider:
+VERSIO_USERNAME=<your login> \
+VERSIO_PASSWORD=<your password> \
+lego --email you@example.com --dns versio --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
VERSIO_PASSWORD |
+Basic authentication password | +
VERSIO_USERNAME |
+Basic authentication username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VERSIO_ENDPOINT |
+The endpoint URL of the API Server | +
VERSIO_HTTP_TIMEOUT |
+API request timeout | +
VERSIO_POLLING_INTERVAL |
+Time between DNS propagation check | +
VERSIO_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VERSIO_SEQUENCE_INTERVAL |
+Time between sequential requests, default 60s | +
VERSIO_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
To test with the sandbox environment set VERSIO_ENDPOINT=https://www.versio.nl/testapi/v1/
Configuration for VinylDNS.
+vinyldnsHere is an example bash command using the VinylDNS provider:
+VINYLDNS_ACCESS_KEY=xxxxxx \
+VINYLDNS_SECRET_KEY=yyyyy \
+VINYLDNS_HOST=https://api.vinyldns.example.org:9443 \
+lego --email you@example.com --dns vinyldns --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
VINYLDNS_ACCESS_KEY |
+The VinylDNS API key | +
VINYLDNS_HOST |
+The VinylDNS API URL | +
VINYLDNS_SECRET_KEY |
+The VinylDNS API Secret key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VINYLDNS_POLLING_INTERVAL |
+Time between DNS propagation check | +
VINYLDNS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VINYLDNS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
The vinyldns integration makes use of dotted hostnames to ease permission management. +Users are required to have DELETE ACL level or zone admin permissions on the VinylDNS zone containing the target host.
+Configuration for VK Cloud.
+vkcloudHere is an example bash command using the VK Cloud provider:
+VK_CLOUD_PROJECT_ID="<your_project_id>" \
+VK_CLOUD_USERNAME="<your_email>" \
+VK_CLOUD_PASSWORD="<your_password>" \
+lego --email you@example.com --dns vkcloud --domains "example.org" --domains "*.example.org" run
+| Environment Variable Name | +Description | +
|---|---|
VK_CLOUD_PASSWORD |
+Password for VK Cloud account | +
VK_CLOUD_PROJECT_ID |
+String ID of project in VK Cloud | +
VK_CLOUD_USERNAME |
+Email of VK Cloud account | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VK_CLOUD_DNS_ENDPOINT |
+URL of DNS API. Defaults to https://mcs.mail.ru/public-dns but can be changed for usage with private clouds | +
VK_CLOUD_DOMAIN_NAME |
+Openstack users domain name. Defaults to users but can be changed for usage with private clouds |
+
VK_CLOUD_IDENTITY_ENDPOINT |
+URL of OpenStack Auth API, Defaults to https://infra.mail.ru:35357/v3/ but can be changed for usage with private clouds | +
VK_CLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
VK_CLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VK_CLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
You can find all required and additional information on “Project/Keys” page of your cloud.
+| ENV Variable | +Parameter from page | +
|---|---|
| VK_CLOUD_PROJECT_ID | +Project ID | +
| VK_CLOUD_USERNAME | +Username | +
| VK_CLOUD_DOMAIN_NAME | +User Domain Name | +
| VK_CLOUD_IDENTITY_ENDPOINT | +Identity endpoint | +
Configuration for Vscale.
+vscaleHere is an example bash command using the Vscale provider:
+VSCALE_API_TOKEN=xxxxx \
+lego --email you@example.com --dns vscale --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
VSCALE_API_TOKEN |
+API token | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VSCALE_BASE_URL |
+API endpoint URL | +
VSCALE_HTTP_TIMEOUT |
+API request timeout | +
VSCALE_POLLING_INTERVAL |
+Time between DNS propagation check | +
VSCALE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VSCALE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Vultr.
+vultrHere is an example bash command using the Vultr provider:
+VULTR_API_KEY=xxxxx \
+lego --email you@example.com --dns vultr --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
VULTR_API_KEY |
+API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
VULTR_HTTP_TIMEOUT |
+API request timeout | +
VULTR_POLLING_INTERVAL |
+Time between DNS propagation check | +
VULTR_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
VULTR_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Websupport.
+websupportHere is an example bash command using the Websupport provider:
+WEBSUPPORT_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
+WEBSUPPORT_SECRET="yyyyyyyyyyyyyyyyyyyyy" \
+lego --email myemail@example.com --dns websupport --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
WEBSUPPORT_API_KEY |
+API key | +
WEBSUPPORT_SECRET |
+API secret | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
WEBSUPPORT_HTTP_TIMEOUT |
+API request timeout | +
WEBSUPPORT_POLLING_INTERVAL |
+Time between DNS propagation check | +
WEBSUPPORT_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
WEBSUPPORT_SEQUENCE_INTERVAL |
+Time between sequential requests | +
WEBSUPPORT_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for WEDOS.
+wedosHere is an example bash command using the WEDOS provider:
+WEDOS_USERNAME=xxxxxxxx \
+WEDOS_WAPI_PASSWORD=xxxxxxxx \
+lego --email you@example.com --dns wedos --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
WEDOS_USERNAME |
+Username is the same as for the admin account | +
WEDOS_WAPI_PASSWORD |
+Password needs to be generated and IP allowed in the admin interface | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
WEDOS_HTTP_TIMEOUT |
+API request timeout | +
WEDOS_POLLING_INTERVAL |
+Time between DNS propagation check | +
WEDOS_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
WEDOS_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Yandex PDD.
+yandexHere is an example bash command using the Yandex PDD provider:
+YANDEX_PDD_TOKEN=<your PDD Token> \
+lego --email you@example.com --dns yandex --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
YANDEX_PDD_TOKEN |
+Basic authentication username | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
YANDEX_HTTP_TIMEOUT |
+API request timeout | +
YANDEX_POLLING_INTERVAL |
+Time between DNS propagation check | +
YANDEX_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
YANDEX_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Yandex Cloud.
+yandexcloudHere is an example bash command using the Yandex Cloud provider:
+YANDEX_CLOUD_IAM_TOKEN=<base64_IAM_token> \
+YANDEX_CLOUD_FOLDER_ID=<folder/project_id> \
+lego --email you@example.com --dns yandexcloud --domains "example.org" --domains "*.example.org" run
+
+# ---
+
+YANDEX_CLOUD_IAM_TOKEN=$(echo '{ \
+ "id": "<string id>", \
+ "service_account_id": "<string id>", \
+ "created_at": "<datetime>", \
+ "key_algorithm": "RSA_2048", \
+ "public_key": "-----BEGIN PUBLIC KEY-----<rsa public key>-----END PUBLIC KEY-----", \
+ "private_key": "-----BEGIN PRIVATE KEY-----<rsa private key>-----END PRIVATE KEY-----" \
+}' | base64) \
+YANDEX_CLOUD_FOLDER_ID=<yandex cloud folder(project) id> \
+lego --email you@example.com --dns yandexcloud --domains "example.org" --domains "*.example.org" run
+| Environment Variable Name | +Description | +
|---|---|
YANDEX_CLOUD_FOLDER_ID |
+The string id of folder (aka project) in Yandex Cloud | +
YANDEX_CLOUD_IAM_TOKEN |
+The base64 encoded json which contains inforamtion about iam token of serivce account with dns.admin permissions |
+
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
YANDEX_CLOUD_POLLING_INTERVAL |
+Time between DNS propagation check | +
YANDEX_CLOUD_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
YANDEX_CLOUD_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
The simplest way to retrieve IAM access token is usage of yc-cli, +follow docs to get it
+yc iam key create --service-account-name my-robot --output key.json
+cat key.json | base64
+Configuration for Zone.ee.
+zoneeeHere is an example bash command using the Zone.ee provider:
+ZONEEE_API_USER=xxxxx \
+ZONEEE_API_KEY=yyyyy \
+lego --email you@example.com --dns zoneee --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ZONEEE_API_KEY |
+API key | +
ZONEEE_API_USER |
+API user | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
ZONEEE_ENDPOINT |
+API endpoint URL | +
ZONEEE_HTTP_TIMEOUT |
+API request timeout | +
ZONEEE_POLLING_INTERVAL |
+Time between DNS propagation check | +
ZONEEE_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
ZONEEE_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
Configuration for Zonomi.
+zonomiHere is an example bash command using the Zonomi provider:
+ZONOMI_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --email you@example.com --dns zonomi --domains my.example.org run
+| Environment Variable Name | +Description | +
|---|---|
ZONOMI_API_KEY |
+User API key | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.
| Environment Variable Name | +Description | +
|---|---|
ZONOMI_HTTP_TIMEOUT |
+API request timeout | +
ZONOMI_POLLING_INTERVAL |
+Time between DNS propagation check | +
ZONOMI_PROPAGATION_TIMEOUT |
+Maximum waiting time for DNS propagation | +
ZONOMI_TTL |
+The TTL of the TXT record used for the DNS challenge | +
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
+More information here.